\u00c9pi\u00e9es, suivies, tourment\u00e9es : 70% des victimes de violence conjugales rapportent de la violence technologique. Alors que l'environnement techno autour des victimes se complexifient, comment peut-on travailler \u00e0 augmenter la litt\u00e9ratie num\u00e9rique aupr\u00e8s des populations vuln\u00e9rables et mettre en place des outils de soutien.
\r\n\r\nIntroduction au ph\u00e9nom\u00e8ne et ampleur
\r\nComment peut-on reconna\u00eetre la violence technologique, quels sont les impacts sur la victime et les proches de celle-ci et qu'est-ce qui explique que ce soit d\u00e9sormais une r\u00e9alit\u00e9 omnipr\u00e9sente pour les victimes de violence conjugale. \r\n\r\n\u00c9tudes de cas r\u00e9els (anonymis\u00e9s) et potentiels
\r\nComment reconna\u00eetre la violence technologique et pr\u00e9sentation de situations bien r\u00e9elles - attention, contenu sensible.\r\n\r\nBonnes pratique d'intervention
\r\nComment reconna\u00eetre les besoins de la victime : intervenir dans un contexte parfois dangereux - comment se prot\u00e9ger soi, savoir quand escalader aux forces de l'ordre et moduler l'intervention en fonction des connaissances techniques de la victime. \r\n\r\nCouverture des aspects l\u00e9gaux / Comment pr\u00e9parer un dossier de preuves
\r\nQu'elles sont les limites de l'aide qui peut \u00eatre offerte? Comment monter un dossier de preuves afin de permettre \u00e0 la victime d'acc\u00e9der \u00e0 des ressources suppl\u00e9mentaires, d'\u00eatre prise au s\u00e9rieux et de porter plainte. \r\n\r\nExploration des outils et ressources disponibles et \u00e0 d\u00e9velopper par la communaut\u00e9
\r\nQuelles sont les outils et ressources d\u00e9j\u00e0 existants dans l'\u00e9cosyst\u00e8me et que devrions nous d\u00e9velopper en tant qu'experts dans la communaut\u00e9 pour soutenir les refuges, centre d'interventions et les victimes.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9PVSBL", "name": "Catherine Dupont-Gagnon", "avatar": null, "biography": "Co-fondatrice de l'association cybercitoyen.org et co-autrice du livre On Vous Trompe. \r\nJ'aspire \u00e0 rendre accessible le contenu en cybers\u00e9curit\u00e9 et \u00e0 augmenter la litt\u00e9ratie num\u00e9rique du grand public afin de combattre la d\u00e9sinformation, les violences technologiques et les fraudes en ligne.", "public_name": "Catherine Dupont-Gagnon", "guid": "8c4fd95e-212f-52a4-b6ec-a59e07142238", "url": "https://cfp.hackfest.ca/hf2023/speaker/9PVSBL/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/U8AXSF/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/U8AXSF/", "attachments": []}, {"guid": "bb9dbef6-1e95-50e9-83f2-4fa60afbf05e", "code": "ZGFADY", "id": 216, "logo": null, "date": "2023-10-13T16:30:00-04:00", "start": "16:30", "duration": "00:50", "room": "Track #2", "slug": "hf2023-216-unconditionally-conditional-strong-authentication-in-azure-ad", "url": "https://cfp.hackfest.ca/hf2023/talk/ZGFADY/", "title": "Unconditionally Conditional - Strong Authentication in Azure AD", "subtitle": "", "track": "Defensive", "type": "Regular Talk", "language": "en", "abstract": "Conditional Access in Microsoft Azure Active Directory, when tied with Mobile Application Management and Mobile Device Management in Microsoft Intune are the core pillars for building zero trust based access controls in Microsoft 365 and Azure published services. We will cover MDM and MAM policies, how Intune device compliance is applied to Conditional Access by Intune, when deploying authentication and most importantly a tested model for layered access, specifically as it relates to M365 in a variety of trust states.", "description": "This could be considered for Defensive or Security 101.\r\n\r\n- Introduction / Agenda / whomi 2 mins\r\n- Overview - why conditional access is important, how relates to zero trust - 3 mins\r\n- Microsoft Intune - start with devices - discuss various aspects of different method of joining devices and assessing device compliance using MS Intune - 15 mins\r\n - Device join types\r\n - Requirements for Hybrid Azure joined and Co-Managed\r\n - MDM vs MAM - differences, similarities and how they relate to one another in a layered approach.\r\n - MDM policies - details regarding options, successes, and pitfalls when applying device compliance policies.\r\n - MAM policies - details regarding options, successes, and pitfalls when applying application/container compliance policies.\r\n - Limitations - notable additional limitations within Intune, especially as it relates to method of onboarding devices, where compliance fits in relation to configuration profiles.\r\n - What else does Intune do? - reporting, patch management\r\nConditional Access policies - there are a number of complications to how conditional access policies apply. Inclusion vs exclusion of items, objects, etc. Detailed discussion of the various filters and controls, how each is applied and managed - 15 mins\r\n - Users\r\n - Applications & Actions\r\n - Conditions\r\n - Sessions\r\n - Controls\r\n - Device filters\r\n - Limitations & Challenges - limitations discovered during large scale implementation\r\n- Putting it all together - 10 mins\r\n - Wide policies vs specific policies - affects of widely applied vs specific policies.\r\n - OS specific policies \r\n - Browser only vs App policies - settings that don't work on one or the other.\r\n - Interesting special cases - things that should never happen, but seem to all the time. Things you will want to block, control, or manage. \r\n- A blueprint from least to most trust across a grid of situations - 5 mins\r\n - Includes BYOD, On premise, off premise, fully managed, completely unmanaged and untrusted.\r\n - How this relates to healthcare settings\r\n - References\r\nQuestions - 5 mins", "recording_license": "", "do_not_record": false, "persons": [{"code": "XCAVFF", "name": "Don Mallory", "avatar": null, "biography": "Don Mallory has over 30 years of experience in enterprise IT, primarily in critical infrastructure, specializing in operations, data storage, disaster recovery, and security for critical infrastructure. Professionally, Don is a Senior Security Analyst in the healthcare sector. He has been involved in various volunteer activities including C3X as a builder and mentor, co-organizer of Hak4Kidz Toronto and the Latow Photographer's Guild at the Art Gallery of Burlington, where he teaches traditional wet darkroom photography.", "public_name": "Don Mallory", "guid": "4a433e14-e357-5a61-a5ab-36929f406572", "url": "https://cfp.hackfest.ca/hf2023/speaker/XCAVFF/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/ZGFADY/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/ZGFADY/", "attachments": []}, {"guid": "37b755fc-001b-59ff-b6d4-b3cb1626febf", "code": "CGJ3ES", "id": 187, "logo": "https://cfp.hackfest.ca/media/hf2023/images/CGJ3ES/mitmpstnlogo_NxwfuMh.png", "date": "2023-10-13T17:30:00-04:00", "start": "17:30", "duration": "00:20", "room": "Track #2", "slug": "hf2023-187-mitm-on-pstn-novel-methods-for-intercepting-phone-calls", "url": "https://cfp.hackfest.ca/hf2023/talk/CGJ3ES/", "title": "MITM on PSTN -- novel methods for intercepting phone calls", "subtitle": "", "track": "Offensive", "type": "Speed Talk", "language": "en", "abstract": "In this talk the author proposes a novel method for intercepting phone calls over PSTN, including mobile networks.\r\nWe'll briefly each discuss the necessary components of the attack, including Caller ID spoofing, SS7, call diverts, and social engineering, and then join the all together to form the novel attack method.", "description": "Two separate methods will be proposed.\r\nThe author will provide a pre-recorded demo of each attack. \r\n\r\n\r\n1. PSTN / MN / CLIP / CNAM\r\n2. SS7 features and attacks\r\n3. Relevant social engineering techniques\r\n4. Attack 1: Simultaneous ring attack\r\n5. Attack 2: Diversion attack\r\n6. Tactic 1: Interception of phone calls\r\n7. Tactic 2: Alteration of phone calls (content)\r\n8. Tactic 2: Alteration of phone calls (metadata)\r\n9. Proposed solutions\r\n\r\nNote that the presentation includes pre-recorded demos as it's ill-advised to do this live in a conference for legal reasons.", "recording_license": "", "do_not_record": false, "persons": [{"code": "FRZKR3", "name": "Kirils Solovjovs", "avatar": null, "biography": "Kirils Solovjovs is an IT policy activist, bug bounty hunter, and the most visible white-hat hacker in Latvia having discovered and responsibly disclosed or reported multiple security vulnerabilities in information systems of both national and international significance. He has extensive experience in social engineering, penetration testing, network flow analysis, reverse engineering, and the legal dimension.\r\n\r\nHe has developed the jailbreak tool for Mikrotik RouterOS, as well as created e-Saeima, helping the Latvian Parliament become the first parliament in the world that is prepared for a fully remote legislative process. He has spoken at many amazing conferences including Hack In The Box, Hack in Paris, TyphoonCon, MCH2022, 35C3, CONFidence, BalCCon, Nullcon, and of course Hackfest.", "public_name": "Kirils Solovjovs", "guid": "60d34ff6-7be5-5eaf-bab3-484763e8ebb9", "url": "https://cfp.hackfest.ca/hf2023/speaker/FRZKR3/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/CGJ3ES/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/CGJ3ES/", "attachments": []}], "Workshops & Speed": [{"guid": "1eb62642-983e-54cc-b771-c5f4d3022300", "code": "ADCHRP", "id": 185, "logo": null, "date": "2023-10-13T09:00:00-04:00", "start": "09:00", "duration": "00:50", "room": "Workshops & Speed", "slug": "hf2023-185-the-dark-side-of-cloud-attack-tools-underground-style", "url": "https://cfp.hackfest.ca/hf2023/talk/ADCHRP/", "title": "The Dark side of Cloud attack tools (underground style)", "subtitle": "", "track": "Offensive", "type": "Regular Talk", "language": "en", "abstract": "I'll show you an analysis of 3 cloud hacking tools that were taken from the underground. These tools are being used these days by hackers and being sold/downloadable on the Darknet and other hackers forums. You will be amazed how simple to use these tools are and how easy it is to operate them. These tools are the first phase of hacking cloud accounts and emails. We will focus on brute force and password spraying tools, show you the tools, what they are doing and a deep analysis of the tools including decryption of their encrypted communication. To wrap it up we will talk about the current landscape changes of cloud attacks.", "description": "I'll show you an analysis of 3 cloud hacking tools that were taken from the underground. These tools are being used these days by hackers and being sold/downloadable on the Darknet and other hackers forums. You will be amazed how simple to use these tools are and how easy it is to operate them. These tools are the first phase of hacking cloud accounts and emails. We will focus on brute force and password spraying tools, show you the tools, what they are doing and a deep analysis of the tools including decryption of their encrypted communication. To wrap it up we will talk about the current landscape changes of cloud attacks. \r\n\r\n\r\n5 Minutes - Opening\r\n5 Minute - Where did I got the tools\r\n10 Minutes - 1st hacking tool analysis and explanation \r\n10 Minutes - 2st hacking tool analysis and explanation \r\n10 Minutes - 3st hacking tool analysis and explanation \r\n5 Minutes - The current attack landscape of the cloud\r\n5 Minutes Q&A", "recording_license": "", "do_not_record": false, "persons": [{"code": "9Z8P9X", "name": "Yaniv Miron", "avatar": null, "biography": "Yaniv Miron - While finding interest in computers, networks and cyber security from a young age he worked as a security consultant and researcher for years. He holds a CISO certification from The Israeli Institute of Technology in addition to certifications as Certified Expert Penetration Tester (CEPT), Certified Reverse Engineering Analyst (CREA), Certified SCADA Security Architect (CSSA) and Win32 Exploit Development. Mr. Miron found 0-days in Microsoft products, Oracle products and others and have reported and credited for these issues. he is a worldwide speaker in hacking and security conferences as BlackHat, HackFest, Power Of Community, Confidence, IL.Hack and Hacker Halted. Mr. Miron is an entrepreneur and inventor with years of experience managing startups, turning startups from an idea to a fully working solution. LinkedIn profile: https://www.linkedin.com/in/yanivmiron/", "public_name": "Yaniv Miron", "guid": "c7787399-d326-5aba-aaf8-2eaa7204ff08", "url": "https://cfp.hackfest.ca/hf2023/speaker/9Z8P9X/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/ADCHRP/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/ADCHRP/", "attachments": []}, {"guid": "9c944943-3200-556d-a404-b921257223a4", "code": "KQGZLF", "id": 238, "logo": "https://cfp.hackfest.ca/media/hf2023/images/KQGZLF/Art_of_Threat_Hunting_FK4LsdU.png", "date": "2023-10-13T11:00:00-04:00", "start": "11:00", "duration": "00:50", "room": "Workshops & Speed", "slug": "hf2023-238-the-art-science-of-threat-hunting-endpoint-signal", "url": "https://cfp.hackfest.ca/hf2023/talk/KQGZLF/", "title": "The Art & Science of Threat Hunting Endpoint Signal", "subtitle": "", "track": "Sponsor", "type": "Regular Talk", "language": "en", "abstract": "Threat hunting is both an art and a science. In this session, we\u2019ll cover the basics of threat hunting, what a well-architected program looks like, lessons learned, share ideas and concepts, and conduct a live hunt. \r\n \r\nA proactive security team is an effective security team.\r\nLearn how we can reduce adversary dwell time and increase operational tempo with threat hunting over endpoint telemetry.", "description": "The 2022 cyber threat landscape was defined by persistence, increased target\r\nscope and relentless determination. As businesses began to ease pandemic-driven\r\noperating environments and adjust to geopolitical shifts and growing economic\r\nhardships, adversaries supporting nation-state, eCrime and hacktivist motivations started\r\n2022 with a relentless show of effort that endured throughout the year.\r\nNation-state adversaries engaged in relentless computer network operations throughout\r\n2022, emphasizing the integral role these operations play in supporting state goals.\r\nRussian state-nexus adversaries combined destructive, espionage and information\r\noperations (IO) attacks in constant support of the Ukraine war, and China statenexus adversaries dominated the cyber threat landscape with a significant increase\r\nin espionage operation volume and target scope. Iran continued to focus on regional\r\nespionage campaigns and their now-signature destructive \u201clock-and-leak\u201d operations\r\nleveraging ransomware, and Democratic People\u2019s Republic of Korea (DPRK) state-nexus\r\nadversaries persisted in cryptocurrency theft campaigns to supplement state funds in the\r\nwake of the COVID-19 pandemic and the nation\u2019s long-standing economic hardship.\r\nOver the course of 2022, eCrime adversaries continued to prove their ability to adapt,\r\nsplinter, regroup and flourish in the face of defensive measures. After some of the biggest\r\nand most notorious ransomware enterprise shutdowns, ransomware affiliates moved to new\r\nransomware-as-a-service (RaaS) operations. Additionally, more than 2,500 advertisements\r\nfor access were identified across the criminal underground, representing a 112% increase\r\ncompared to 2021 and demonstrating a clear demand for access broker services.", "recording_license": "", "do_not_record": true, "persons": [{"code": "KYCF7S", "name": "Andrew Munchbach", "avatar": null, "biography": "Andrew is a computer scientist with over fifteen years of experience in endpoint security and related competencies. Andrew joined CrowdStrike in 2015 and currently serves as Vice President of Field Engineering.", "public_name": "Andrew Munchbach", "guid": "ba461415-0b35-5c9f-a813-b3f7d1439980", "url": "https://cfp.hackfest.ca/hf2023/speaker/KYCF7S/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/KQGZLF/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/KQGZLF/", "attachments": []}, {"guid": "802d034d-fa2c-50da-ad0e-efff869d392f", "code": "9BXV9C", "id": 241, "logo": null, "date": "2023-10-13T12:00:00-04:00", "start": "12:00", "duration": "01:30", "room": "Workshops & Speed", "slug": "hf2023-241-ultimate-test-drive-next-generation-firewalls", "url": "https://cfp.hackfest.ca/hf2023/talk/9BXV9C/", "title": "Ultimate Test Drive - Next-Generation Firewalls", "subtitle": "", "track": "Sponsor", "type": "Workshop - 120 minutes", "language": "en", "abstract": "///EN\r\nThis is your chance to get behind the driver\u2019s seat of the industry\u2019s leading network security solutions. This workshop is customized to enhance your understanding of how our products work and how they can improve your organization\u2019s security posture. We\u2019ll take you step-by-step through each of our solutions, with an expert instructor to guide you.\r\n\r\n///FR\r\nVoici l'opportunit\u00e9 de prendre le volant du pare-feu chef de file de l'industrie de la s\u00e9curit\u00e9 des r\u00e9seaux. Cette session vous permettra d'augmenter votre compr\u00e9hension de nos pare-feux, comment les op\u00e9rer, en tirer la valeur pour ultimement, augmenter la posture de s\u00e9curit\u00e9 de votre organisation. Nous vous guiderons \u00e9tape par \u00e9tape \u00e0 travers la solution avec un instructeur expert pour vous soutenir.", "description": "///EN\r\n . Learn to ensure application access is by user-IDs. \r\n . Configure Cloud Identity Engine for authentication and identity/User-ID.\r\n . Create application-based policy with Policy Optimizer. \r\n . Setup granular control for Social Media and Sanctioned SaaS Applications.\r\n . Add new decryption policies to decrypt SSL (TLS 1.3) traffic.\r\n . Create a custom report in the Application Command Center.\r\n . Learn to use the new AIOps dashboards.\r\n\r\nAll you need is your own laptop with Internet access.\r\n\r\n///FR\r\n . S'assurer que les acc\u00e8s aux applications sont contr\u00f4l\u00e9s par UserID.\r\n . Utiliser le service Cloud Identity Engine pour l'authentification et identit\u00e9 UserID.\r\n . Cr\u00e9er des politiques de s\u00e9curit\u00e9 applicatives via le Policy Optimizer. \r\n . Cr\u00e9er des contr\u00f4les granulaires pour les applications des r\u00e9seaux sociaux et SaaS.\r\n . Ajouter des politiques de d\u00e9chiffrement SSL (TLS 1.3).\r\n . G\u00e9n\u00e9rer des rapports personnalis\u00e9s dans l'Application Command Center.\r\n . Apprendre \u00e0 utiliser les tableaux de bords d'AI Ops.\r\n\r\nTout ce dont vous avez besoin est de votre ordinateur portable avec acc\u00e8s \u00e0 l'Internet.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9AMCXU", "name": "Guillaume Roy", "avatar": null, "biography": null, "public_name": "Guillaume Roy", "guid": "86beccf5-1df4-5032-9071-982a9132f5d5", "url": "https://cfp.hackfest.ca/hf2023/speaker/9AMCXU/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/9BXV9C/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/9BXV9C/", "attachments": []}, {"guid": "0941f085-80e9-5f24-8f35-0d88cde3061d", "code": "7NFLVW", "id": 243, "logo": null, "date": "2023-10-13T13:30:00-04:00", "start": "13:30", "duration": "01:00", "room": "Workshops & Speed", "slug": "hf2023-243-cortex-xpanse-capture-the-flag-where-in-the-world-are-your-exposures", "url": "https://cfp.hackfest.ca/hf2023/talk/7NFLVW/", "title": "CORTEX XPANSE CAPTURE THE FLAG: Where in the World are Your Exposures?", "subtitle": "", "track": "Sponsor", "type": "Workshop - 120 minutes", "language": "en", "abstract": "Step into the exciting world of the Cortex Xpanse Capture the Flag challenge! This game invites participants to journey through the Expander UI, tackling a series of intricate challenges. For each challenge conquered, players will be rewarded with a \"flag\" and earn valuable points. The ultimate glory goes to the team or individual who unravels the most mysteries and accumulates the highest score. By participating, you not only get a hands-on experience with Cortex Xpanse but also indulge in a fun, immersive competition. This event is tailored to both seasoned pros and enthusiastic newcomers. Are you up for the challenge? Dive in, learn, compete, and emerge victorious!\r\n\r\nThis game, with a duration of one hour, calls on participants to explore the Expander interface. Make sure to bring your laptop to take part in this challenge.\r\n\r\n=========\r\n\r\nEntrez dans l'univers palpitant du d\u00e9fi Capture the Flag de Cortex Xpanse! Ce jeu invite les participants \u00e0 s'aventurer dans l'interface Expander, en affrontant une s\u00e9rie de d\u00e9fis \u00e9labor\u00e9s. Chaque d\u00e9fi surmont\u00e9 r\u00e9compensera les joueurs avec un \"drapeau\" et leur permettra de gagner des points pr\u00e9cieux. La gloire supr\u00eame est d\u00e9cern\u00e9e \u00e0 l'\u00e9quipe ou \u00e0 l'individu qui d\u00e9voile le plus de myst\u00e8res et obtient le score le plus \u00e9lev\u00e9. En participant, vous b\u00e9n\u00e9ficiez non seulement d'une exp\u00e9rience pratique avec Cortex Xpanse, mais vous vous immergez aussi dans une comp\u00e9tition amusante et immersive. Cet \u00e9v\u00e9nement est adapt\u00e9 aussi bien aux professionnels chevronn\u00e9s qu'aux novices enthousiastes. \u00cates-vous pr\u00eat \u00e0 relever le d\u00e9fi? Plongez, apprenez, concourez et triomphez!\"\r\n\r\n\r\nCe jeu, d'une dur\u00e9e d'une heure, sollicite les participants \u00e0 explorer l'interface d'Expander. Assurez-vous d'apporter votre ordinateur portable pour participer \u00e0 ce d\u00e9fi.", "description": "Step into the exciting world of the Cortex Xpanse Capture the Flag challenge! This game invites participants to journey through the Expander UI, tackling a series of intricate challenges. For each challenge conquered, players will be rewarded with a \"flag\" and earn valuable points. The ultimate glory goes to the team or individual who unravels the most mysteries and accumulates the highest score. By participating, you not only get a hands-on experience with Cortex Xpanse but also indulge in a fun, immersive competition. This event is tailored to both seasoned pros and enthusiastic newcomers. Are you up for the challenge? Dive in, learn, compete, and emerge victorious!\r\n\r\nThis game, with a duration of one hour, calls on participants to explore the Expander interface. Make sure to bring your laptop to take part in this challenge.\r\n\r\n=========\r\n\r\nEntrez dans l'univers palpitant du d\u00e9fi Capture the Flag de Cortex Xpanse! Ce jeu invite les participants \u00e0 s'aventurer dans l'interface Expander, en affrontant une s\u00e9rie de d\u00e9fis \u00e9labor\u00e9s. Chaque d\u00e9fi surmont\u00e9 r\u00e9compensera les joueurs avec un \"drapeau\" et leur permettra de gagner des points pr\u00e9cieux. La gloire supr\u00eame est d\u00e9cern\u00e9e \u00e0 l'\u00e9quipe ou \u00e0 l'individu qui d\u00e9voile le plus de myst\u00e8res et obtient le score le plus \u00e9lev\u00e9. En participant, vous b\u00e9n\u00e9ficiez non seulement d'une exp\u00e9rience pratique avec Cortex Xpanse, mais vous vous immergez aussi dans une comp\u00e9tition amusante et immersive. Cet \u00e9v\u00e9nement est adapt\u00e9 aussi bien aux professionnels chevronn\u00e9s qu'aux novices enthousiastes. \u00cates-vous pr\u00eat \u00e0 relever le d\u00e9fi? Plongez, apprenez, concourez et triomphez!\"\r\n\r\n\r\nCe jeu, d'une dur\u00e9e d'une heure, sollicite les participants \u00e0 explorer l'interface d'Expander. Assurez-vous d'apporter votre ordinateur portable pour participer \u00e0 ce d\u00e9fi.", "recording_license": "", "do_not_record": false, "persons": [{"code": "AL7S9S", "name": "Patrick Hamel", "avatar": null, "biography": null, "public_name": "Patrick Hamel", "guid": "d941e979-a33c-507e-88c6-f3a7f89aaa04", "url": "https://cfp.hackfest.ca/hf2023/speaker/AL7S9S/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/7NFLVW/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/7NFLVW/", "attachments": []}, {"guid": "61a6554d-d05f-576d-86a6-6eed85e08ba9", "code": "ZTQ7DM", "id": 182, "logo": null, "date": "2023-10-13T14:30:00-04:00", "start": "14:30", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-182-how-a-global-retail-hack-breathed-life-into-static-security-analysis", "url": "https://cfp.hackfest.ca/hf2023/talk/ZTQ7DM/", "title": "How a Global Retail Hack Breathed Life Into Static Security Analysis", "subtitle": "", "track": "Defensive", "type": "Speed Talk", "language": "en", "abstract": "Static Application Security Testing (SAST) enables organizations to detect vulnerabilities in code early; however, interviews with application security analysts indicate that SAST reports are often dense and include little to no visual aids. \r\n\r\nOver the Winter and Spring of 2023, my research partner and I invented the Abstract Syntax Tree Reader and Analyzer (ASTRA) which responds to this need of a value-adding and intuitive visual aid for more rapid and thorough consumption of SAST insights. ASTRA is a collection of Python scripts that transforms certain parts of SAST documentation a Universal Graph Format which can be imported into many graphical visualization tools.\r\n\r\nThe key insight from our research is that vulnerability stack traces, which are spread sparsely in the report and often overlooked by security analysts, can be collected and graphed to provide new vulnerability information. Once graphed, principles of graph theory can be applied to make calculations. These include calculating the substructure entropy to discover surprising occurrences and calculating the modularity for the number of vulnerability communities in code repositories. Further, calculating the eigenvector centrality allows us to see the extent to which each individual vulnerability contributes to the overall vulnerability graph of the application. \r\n\r\nAs a result, the files contributing most to the vulnerability profile of the application will be identified. Sections of the applications that are most vulnerable will also be able to be identified. Our transformed ASTRA data has been successfully uploaded into standard 2D and 3D graphing engines, as well as Virtual Reality (VR) simulations so analysts are able to explore SAST results more intuitively, bringing more humanity and rigorous calculation into cyber analysis.", "description": "DESCRIPTION\r\n[Presentation Flow]\r\n\r\n1...Introductions and Presentation Title - 1 min.\r\n\r\n2...Laying Out the Problem Statement - 3 min.\r\n\r\n3...Tool Demo - 2 min.\r\n\r\n4...Capabilties and Use of Graph Theory - 5 min.\r\n\r\n5...Virtual Reality Plug-In - 2 min.\r\n\r\n6...Feasibility Study - 3 min.\r\n\r\n7...Graph Theory - 2 min.\r\n\r\n8...Conclusion, Invite Audience Members to Use Oculus Headset and Visualize (if permitted by Hackfest) - 2+ min. \r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Introductions and Presentation Title]\r\nMy co-speaker and I will introduce ourselves.\r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Laying Out the Problem Statement]\r\nWe draw the crowd in by telling the story of a security incident we were involved in for a retail company. We will describe the hunt for the elusive root cause during which we combed through application scanning reports that were generated in the last code review. We pulled it up, hoping it would provide the answers we needed. But we scrolled through the 1000+ page report, it became clear that it would take too long to manually analyze the data.\r\n\r\nDetermined to find a solution, we began exploring different ways to analyze the application report data. We tried sorting it by severity, looking for patterns and trends, and manually creating visualizations, but nothing seemed to provide the insight we needed. That\u2019s when we stumbled on this research idea that promised to revolutionize one part of the way we solve cyber incidents. \r\n\r\nIn consequence, we developed ASTRA \u2013 Abstract Syntax Tree Reader and Analyzer. By leveraging graph theory and advanced data visualization techniques, the solution could transform the complex application data into easy-to-understand visualizations that would highlight the most critical vulnerabilities.\r\n\r\nASTRA builds an explorable world from endless reports of security documentation. When we run these reports through ASTRA code, the data is re-shaped into a graph. We turn the application\u2019s files into the graph nodes while the lines in the graph (called graph edges) represent a connection between two files.\r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Tool Demo]\r\nWe will play the GraphViz graphical representation and interact with it live in front of the Hackfest audience. The result of ASTRA is this visual representation of the application geometry. I can see the files come alive. I can interact with the most vulnerable files and see how they\u2019re connected. The thicker the graph edge, the higher the number of vulnerabilities are being exchanged between the two files.\r\n\r\nInstead of being tailored to answer a specific question, the beauty of the graph visualization is that it\u2019s just the platform on which anyone can bring their domain expertise, their lens, and their hypotheses. Being set free to explore the application and bringing in more humanity to cyber analysis.\r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Capabilities and Use of Graph Theory]\r\nOur users can filter by how much certain files contribute to and bring down the security health of the application. We can automatically draw lines around the number of clusters or communities for the graphs and use anomaly detection to find surprising or unusual occurrences. The takeaway is that seeing and feeling the application geometry unlocks key security information.\r\n\r\nDuring the live demo at Hackfest, we will run ASTRA on the architecture of the problematic application mentioned at the beginning of the presentation. The client was notified of faulty encryption. Now, instead of looking for it in a 1000-page report, we have the luxury of hovering our cursor over the encryption file. And seeing which files it\u2019s connected to. Here, we see that the culprits jump out at us. \r\n\r\nOur use cases expand beyond conducting a root cause analysis. ASTRA is an accelerator to architecture mapping and threat modeling. It engages developers in security awareness programs and enhances the application security tools that many organizations already use. \r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Virtual Reality and Demo of Virtual Reality Experience]\r\nWhat if we push the envelope even further? What if we could take anything you could experience on a screen and stretch it into your entire field of vision. Enter virtual reality where now we interact with the data as if we are a file on this graph, or maybe \u2026 you\u2019re even the attacker\u2019s payload.\r\n \r\nWith VR we can walk around in this world and interact with the once lifeless words in a thousand-page report. In this way we can shine a light on insights that were locked away in piles of information. Turning our attention to our screens, the main source file has many critical vulnerabilities, and we can see all of the other folders that it calls. The value in ASTRA is when it forces us to notice what we never expected to see. \r\n\r\nHere, we will be providing our own Oculus headset for audience members to try out.\r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Feasibility Study]\r\nIf cyber-crime were a country, it would have the third largest GDP in the world, at $6T dollars in 2021 and growing. So it\u2019s not a surprise there\u2019s a sizable market for defensive cyber tools. Application security tools have a market of $6B and this is the market we\u2019re playing within. We see ASTRA as bundled with an existing application security tool.\r\n\r\nASTRA also satisfies the market trending toward automation. From our own study at a large French-Canadian bank, we found automation in threat modeling can reduce cycles by 35%. Adapting data to ASTRA, we can settle on a conservative ROI of 30%, which means 30% less human time spent on threat modeling, that can be channeled toward productive tasks. \r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Novelty]\r\nTo be clear, graph theory has never been applied before to application security vulnerability analysis. We conducted a literature review and market analysis, including interviews with subject matter experts. The use of graph theory for application security is not currently a feature in any tool on the market, nor in any paper, which we think could increase market attractiveness. \r\n\r\nOur ASTRA technical fundamentals scale to 6000x. That is, our virtual reality simulation would only slow down at 70,000 connections or 6,000 files. The way forward for us is to make it better by bringing in more features, like color coding files in VR. \r\n\r\nASTRA was designed to help visualize threats, but our software can be applied to graphically visualize other kinds of attacks, like those over a network or hardware attacks like IOT devices. \r\n\r\nOur key takeaways are that we can adopt the mindset of genuinely engaging with developers in addition to relying on text-based reports.\r\n\r\nGraph Theory has never been applied before in vulnerability analysis and we are looking forward to what benefits ASTRA could bring. \r\n\r\n-----------------------------------------------------------------------------------------------------------------------------------------------------------------\r\n\r\n[Conclusion]\r\nFuture of work\r\nAs people we have an innate desire to explore and learn on our own. We hope that vision behind ASTRA brings us all one step closer to that future of work.\r\n\r\nIf permitted by Hackfest, we will encourage enthusiastic audience members to come up and experience the virtual reality SAST visualization using a sanitized Accenture-owned Oculus headset that we will provide.", "recording_license": "", "do_not_record": false, "persons": [{"code": "CL9QLE", "name": "Naeem Budhwani", "avatar": null, "biography": "Naeem Budhwani is a cyber defense consultant at Accenture\u2019s Cyber Attack Simulation (CAS) practice. He was previously an associate in PwC Canada\u2019s Cybersecurity & Privacy practice. Across these roles, Naeem has consulted for over a dozen clients, from boutique insurance firms looking to develop IR playbooks to multi-national technology giants undergoing an application security transformation. He is regarded as a Canadian subject matter expert in threat modeling, having been brought in to conduct executive interviews for Crown Corporations and provide large-audience technical application security training to financial institutions.\r\n\r\nNaeem has also delivered guest lectures on application security at Seneca College and York University. He holds a bachelor\u2019s in applied mathematics and computer science from the University of Western Ontario.", "public_name": "Naeem Budhwani", "guid": "d7aa2a3c-c590-5b0a-8cdc-1905d4765140", "url": "https://cfp.hackfest.ca/hf2023/speaker/CL9QLE/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/ZTQ7DM/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/ZTQ7DM/", "attachments": []}, {"guid": "bc3d0de0-0a51-5b53-a9b5-222d716090af", "code": "ASRMBB", "id": 235, "logo": "https://cfp.hackfest.ca/media/hf2023/images/ASRMBB/highlevel_xhkm8oo.png", "date": "2023-10-13T15:00:00-04:00", "start": "15:00", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-235-cryptojacking-defending-against-cloud-compute-resource-abuse", "url": "https://cfp.hackfest.ca/hf2023/talk/ASRMBB/", "title": "Cryptojacking: Defending against cloud compute resource abuse", "subtitle": "", "track": "Defensive", "type": "Speed Talk", "language": "en", "abstract": "As Cloud computing evolves, adversaries can take advantage of new attack surfaces and services. The threat actors are deploying sophisticated campaign strategies to abuse millions of dollars in cloud computing in compromised tenants and subscriptions while avoiding detection. Microsoft's research reveals that targeted organizations faced more than $300,000 in compute fees from cryptojacking attacks.\r\n\r\n\r\nIn this talk, we will explore the attackers\u2019 behaviours that we observed in numerous incidents across many organizations. We will dissect the inner workings of cloud attacks such as cryptojacking and resource abuse. As we move from the Initial Access stage to the Impact stage, we will explore key TTPs (Tactics, Techniques, and Procedures). Additionally, we will explore several ways that threat actors can abuse and hijacking subscriptions that are forensically disruptive. By analyzing footprints and logs, we will provide insights that blue teamers can use to detect and counterattack these at early stage of attacks", "description": "Introduction [3 minutes]\r\n\r\nAs Cloud computing evolves, adversaries can take advantage of new attack surfaces and services. The threat actors are deploying sophisticated campaign strategies to abuse millions of dollars in cloud computing in compromised tenants and subscriptions while avoiding detection. Microsoft's research reveals that targeted organizations faced more than $300,000 in compute fees from cryptojacking attacks. In this presentation, we will share the discovered TTPs (Tactics, Techniques, and Procedures) that we observed in numerous organizations executed by several threat actor groups.\r\n\r\nCryptojacking Anatomy [15 minutes]\r\n\r\nCloud cryptojacking/abuse follows a similar attack lifecycle regardless of the cloud provider. We will dissect the inner workings of cloud these attacks. As we move from the initial access stage to the impact stage, we will explore key TTPs. By analyzing footprints and logs, we will provide insights that blue teamers can use to detect and counterattack these threats especially at early stage of attacks.\r\n\r\n1.\tInitial access - Compromised credentials: Threat actors need compromised credentials with Virtual Machine contributor role to execute attacks, making credential hygiene and cloud hardening crucial. In most of the cases, the compromised accounts did not have multi-factor authentication (MFA) enabled. \r\nAfter gaining access, some threat actors use attacker-controlled virtual machines within legitimate tenants as their operational infrastructure. By using living-off-the-land techniques, threat actors can operate without any infrastructure external to the cloud environment.\r\n2.\tPrivilege escalation - Elevating access: In some cases, threat actors compromise the global administrator account. Global administrator accounts may not possess access to all subscriptions and management groups in the directory; to gain permissions over all resources, the 'elevate access' option must be activated for the account.\r\n3.\tDefense evasion - Subscription hijacking: Once the threat actor compromised the tenant and performed reconnaissance to determine available permissions, the attacker may proceed to transfer (hijack) the subscription to another tenant (attacker-controlled). Subscription hijacking is an evasion technique that allows the threat actor to hide some of their activities from the tenant administrator and security teams. Subscription hijacking is disruptive forensically as all activity logs are stored at subscription level and there would be no events for incident response teams. \r\n4.\tImpact - Increasing core quotas: To boost the cloud compute abuse, the threat actors often increase the Virtual Machine core quota to deploy massive amounts of computing power. GPU compute offerings are often targeted by threat actors. GPU compute provides access to high performance NVIDIA and AMD GPU cores, allowing cryptocurrency mining magnitudes more effective than any CPU compute offering.\r\n5.\tImpact - Deploying compute: Malicious provisioning behavior of compute generally does not match existing compute provisioning patterns within the tenant. Threat actor ultimately needs to provision compute very quickly to make the attack profitable. This time restriction means that patterns in provisioning generally emerge over relatively short periods of time.\r\n6.\tImpact - Mining cryptocurrency: Once subscription is compromise and the compute is created, the threat actor can begin mining cryptocurrency by deploying mining software to the newly created VMs. The installed mining software joins the VM to a mining pool, which allows the threat actor to pool their stolen processing power from multiple compromised tenants. Threat actors may need to install GPU drivers to take full advantage of the graphics card, especially on N-series VMs. Actors have been observed abusing Azure Virtual Machine extensions such as an NVIDIA GPU Driver Extension for Windows or Linux, or an AMD GPU Driver Extension for Windows, to facilitate driver installation.\r\n\r\nKey Take away for:\r\n1.\tBlue Teamers and threat hunters: Take in new TTPs observed by Microsoft experts on several compromised cases and practical information to build high fidelity detections.\r\n2.\tRed Teamers: Get up to speed with related techniques used by ATPs (Advanced persistent threat) which are tracked by Microsoft security experts.\r\n3.\tGRC and Management: Understanding of strategies to strengthen cloud security postures, protect cloud workloads, and defend against a wide range of cloud-based threats and risks.\r\n\r\n\r\nQuestions [2 minutes]", "recording_license": "", "do_not_record": false, "persons": [{"code": "CPLV9R", "name": "Amir Gharib", "avatar": null, "biography": "Amir Gharib is a senior security researcher at Microsoft. His main responsibility is to improve Microsoft\u2019s detection capabilities across different workloads by researching novel attacks and detection mechanisms. As part of his role, he leverages events and signals from a variety of workloads and products to develop high-fidelity detection that can be used to disrupt attacks automatically. In the past, he was a technical manager at PwC performing incident response, threat hunting, and detection engineering. Furthermore, he worked with IBM Qradar to develop UEBA solutions for users and entities. He currently holds GCFA certification and a Master of Computer Science (MCS) degree specialized in cybersecurity. He has published and presented at several international conferences and journals. His publications have received more than 600 citations in recent years. Outside of work, he enjoys spending time with his family (plus his dog) and friends. He is currently training toward his private pilot license (PPL).", "public_name": "Amir Gharib", "guid": "e67b3abe-928a-58b2-bf66-be71e38a5e6b", "url": "https://cfp.hackfest.ca/hf2023/speaker/CPLV9R/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/ASRMBB/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/ASRMBB/", "attachments": []}, {"guid": "d35833ab-3f33-578f-b4a9-c5e678b536d3", "code": "GVFX3J", "id": 184, "logo": null, "date": "2023-10-13T15:30:00-04:00", "start": "15:30", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-184-les-nouveaux-business-du-blackmarket", "url": "https://cfp.hackfest.ca/hf2023/talk/GVFX3J/", "title": "Les nouveaux \"Business\" du blackmarket", "subtitle": "", "track": "Threat Intelligence / OSINT", "type": "Speed Talk", "language": "fr", "abstract": "Concours de tatouage, vol de bus, d\u00e9tournement de panneau publicitaire, \"black friday\" et soldes, Etc. Le blackmarket a \u00e9volu\u00e9, en 30 ans, pour proposer un marketing de la malveillance agressif.", "description": "Dans un monde o\u00f9 le march\u00e9 noir est en expansion constante, il devient essentiel pour les professionnels de la cybers\u00e9curit\u00e9, des chefs d'entreprises ou du \"simple\" citoyen de comprendre les d\u00e9fis qui se pr\u00e9sentent dans ce secteur illicite. La conf\u00e9rence explorera les strat\u00e9gies et les tactiques utilis\u00e9es par les acteurs du march\u00e9 noir pour promouvoir et vendre leurs produits et services (faux papiers, failles, acc\u00e8s, brokers, Etc). Comprendre leur fonctionnement pour mieux s'en prot\u00e9ger !\r\n\r\nPoints cl\u00e9s abord\u00e9s :\r\n\r\nIntroduction au march\u00e9 noir : d\u00e9finition, tendances actuelles et enjeux. [2mns]\r\nLes acteurs du march\u00e9 noir : comprendre leur motivation et leurs cibles. [2 mns]\r\nTechniques de marketing illicites : publicit\u00e9 clandestine, vente en ligne anonyme, vol de bus, promotions, concours (gagner 5 grammes de coca\u00efne ; ...) [10 mns]\r\n\u00c9tudes de cas : exemples concrets de campagnes de marketing dans le black market. [5 mns]\r\n\r\nObjectifs de la conf\u00e9rence :\r\nComprendre les strat\u00e9gies et les tactiques de marketing utilis\u00e9es dans le march\u00e9 noir.\r\nSensibiliser aux risques li\u00e9s \u00e0 ces pratiques.\r\nEncourager la r\u00e9flexion et les d\u00e9bats sur la r\u00e9glementation et la lutte contre le march\u00e9 noir.\r\n\r\nPublic cible :\r\nCette conf\u00e9rence s'adresse aux professionnels du marketing, aux entrepreneurs, aux juristes, aux \u00e9tudiants, ainsi qu'\u00e0 tous ceux qui souhaitent comprendre les dynamiques et les enjeux du marketing dans le march\u00e9 noir.", "recording_license": "", "do_not_record": false, "persons": [{"code": "37ZG99", "name": "Damien Bancal", "avatar": null, "biography": "Damien Bancal est un expert en cyber intelligence fran\u00e7ais. Il est connu pour son travail dans le domaine de la sensibilisation \u00e0 la s\u00e9curit\u00e9 informatique. Depuis plus de 30 ans, il \u00e9vang\u00e9lise sur toutes les questions li\u00e9es \u00e0 la protection des donn\u00e9es personnelles.\r\n\r\nDamien Bancal est le fondateur des sites Internet Zataz.ca, datasecuritybreach.fr et veillezataz.com. Il y partage des informations sur les fuites de donn\u00e9es, les failles de s\u00e9curit\u00e9 \u00e0 corriger et les cyberattaques. \r\nSon objectif principal est d'alerter, informer et \u00e9duquer les utilisateurs sur les menaces li\u00e9es \u00e0 la cybercriminalit\u00e9.\r\n\r\nAuteur de 16 livres, il a travaill\u00e9 1 an \u00e0 Montr\u00e9al et pour une quarantaine de m\u00e9dia de part le monde.\r\nIl a adore la poutine !", "public_name": "Damien Bancal", "guid": "93e2c1fc-8732-50ad-88be-ea3801076a84", "url": "https://cfp.hackfest.ca/hf2023/speaker/37ZG99/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/GVFX3J/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/GVFX3J/", "attachments": []}, {"guid": "e3582705-3280-54a1-a0b5-c6bae5989241", "code": "GHPW9Y", "id": 242, "logo": null, "date": "2023-10-13T16:00:00-04:00", "start": "16:00", "duration": "01:30", "room": "Workshops & Speed", "slug": "hf2023-242-ultimate-test-drive-cloud-delivered-security-services", "url": "https://cfp.hackfest.ca/hf2023/talk/GHPW9Y/", "title": "Ultimate Test Drive - Cloud Delivered Security Services", "subtitle": "", "track": "Sponsor", "type": "Workshop - 120 minutes", "language": "en", "abstract": "///EN\r\nThis is your chance to get behind the driver\u2019s seat of the industry\u2019s leading network security solutions. This workshop is customized to enhance your understanding of how our products work and how they can improve your organization\u2019s security posture. We\u2019ll take you step-by-step through each of our solutions, with an expert instructor to guide you. Learn how to protect your network and detect known, unknown and zero-day threats 180X faster than any other platform or point solution \u2013 all within a single, integrated best-of-breed security platform.\r\n\r\n///FR\r\nVoici l'opportunit\u00e9 de prendre le volant du pare-feu chef de file de l'industrie de la s\u00e9curit\u00e9 des r\u00e9seaux. Cette session vous permettra d'augmenter votre compr\u00e9hension de nos pare-feux, comment les op\u00e9rer, en tirer la valeur pour ultimement, augmenter la posture de s\u00e9curit\u00e9 de votre organisation. Nous vous guiderons \u00e9tape par \u00e9tape \u00e0 travers la solution avec un instructeur expert pour vous soutenir.", "description": "///EN\r\nExperience the value firsthand and see how you can:\r\n . Prevent 60% more unknown injection attacks that traditional IPS solutions miss.\r\n . Stop 26% more zero-day malware than traditional sandboxes.\r\n . Apply predictive analytics to disrupt attacks that attempt to exploit DNS traffic to cause harm.\r\n . Detect and prevent 40% more threats than traditional web filtering databases with inline \r\n machine learning (ML)-powered web security that blocks new and evasive malicious websites.\r\n . Discover 90% of devices in the first 48 hours and expand visibility to all devices for IT and security teams \u2013 even devices never seen before.\r\n\r\nAll you need is your own laptop with Internet access.\r\n\r\n///FR\r\n\r\nApprenez comment prot\u00e9ger votre r\u00e9seau et d\u00e9tecter les attaques inconnues et zero day 180x plus rapidement qu'avec toute autre plateforme et ce, avec une console centralis\u00e9e de gestion.\r\n. Pr\u00e9venir 60% plus d'attaques d'injections que les solutions IPS traditionnelles.\r\n. Bloquer 26% plus d'attaques zero day de logiciels malveillants que les solutions de d\u00e9tonation traditionnelles.\r\n. Appliquer des techniques d'analyses pr\u00e9ventives sur les attaques exploitant le traffic DNS.\r\n. D\u00e9tecter et pr\u00e9venir 40% plus de menaces \u00e9vasives avec l'apprentissage machine (ML) que les solution traditionnelles de filtrage URL.\r\n. D\u00e9couvrir 90% des \u00e9quipements r\u00e9seaux lors des premi\u00e8res 48h et continuellement augmenter la visibilit\u00e9 de vos \u00e9quipements de l'Internet des objets.\r\n\r\nTout ce dont vous avez besoin est de votre ordinateur portable avec acc\u00e8s \u00e0 l'Internet.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9AMCXU", "name": "Guillaume Roy", "avatar": null, "biography": null, "public_name": "Guillaume Roy", "guid": "86beccf5-1df4-5032-9071-982a9132f5d5", "url": "https://cfp.hackfest.ca/hf2023/speaker/9AMCXU/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/GHPW9Y/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/GHPW9Y/", "attachments": []}]}}, {"index": 2, "date": "2023-10-14", "day_start": "2023-10-14T04:00:00-04:00", "day_end": "2023-10-15T03:59:00-04:00", "rooms": {"Track #1": [{"guid": "3537d418-1468-55f8-877d-03e3126132e8", "code": "8B3QB8", "id": 197, "logo": "https://cfp.hackfest.ca/media/hf2023/images/8B3QB8/profile_L0qicIx.jpg", "date": "2023-10-14T09:00:00-04:00", "start": "09:00", "duration": "00:50", "room": "Track #1", "slug": "hf2023-197-gamepwn-101-introduction-to-game-hacking", "url": "https://cfp.hackfest.ca/hf2023/talk/8B3QB8/", "title": "GamePwn 101 - Introduction to Game Hacking", "subtitle": "", "track": "Offensive", "type": "Regular Talk", "language": "en", "abstract": "In the rapidly evolving landscape of gaming, understanding the realm of game hacking is essential, especially in multiplayer games. While some people engage in game hacking for fun or as a hobby, others use it to cheat and gain an advantage in online multiplayer games, which can ruin the experience for other players. As we delve together into this captivating subject, I will explore the fundamentals of game hacking, including its definition, real-world examples, common methods employed by hackers, and the measures implemented to counter such exploits.\r\n\r\nDiscover the intriguing world of cheats, bots, and exploits that have impacted the gaming industry. I will showcase notable instances where game hacking has disrupted fair play and affected player experiences. By examining these examples, I aim to raise awareness about the potential consequences and implications of game hacking. Furthermore, we will delve into the various techniques employed by hackers, such as memory editing, code injection, and packet manipulation. Understanding these methods is vital to recognize vulnerabilities and formulating effective countermeasures.\r\n\r\nThe discussion will also encompass the proactive steps taken by game developers to combat cheating, including encryption, client-server validation, behavior monitoring, and regular updates. By understanding these anti-cheat measures, we can gain insights into the ongoing battle between game developers and hackers. Lastly, we will explore the future of game hacking within the broader information security landscape, considering emerging technologies, evolving security measures, and the potential impact on the gaming industry.", "description": "This talk will be divided into the following five sections.\r\n\r\n1) What is game hacking?\r\n\r\nThis section serves as a brief introduction to game hacking. I will explain that game hacking involves modifying game code, data, or mechanics to gain an unfair advantage or access hidden content. I will also explore the motivations behind game hacking, such as achieving high scores, gaining prestige, or economic incentives in online games. The importance of understanding game hacking within the broader context of information security is emphasized.\r\n\r\n2) Real-world examples of game hacking (cheats, bots, exploits)\r\n\r\nThis segment showcases a range of real-world examples to illustrate the impact of game hacking. It covers cheats like aimbots, which provide enhanced aiming abilities, wallhacks that allow players to see through walls, and speed hacks that increase movement speed. The discussion also highlights the usage of bots for automated gameplay and farming resources. Additionally, it delves into exploits, such as duplication glitches or accessing restricted areas. Each example is explained in detail, discussing how they disrupt fair play and affect player experiences.\r\n\r\n3) Common game hacking methods\r\n\r\nThis section provides an in-depth exploration of the common methods employed by game hackers. It starts with memory editing, where hackers manipulate values stored in a game's memory to gain advantages like infinite health or unlimited resources. Code injection is then explained, involving the injection of custom code into a game's executable to modify its behavior. The discussion further includes techniques like packet manipulation, where network packets are intercepted and modified to gain unfair advantages. The inner workings of each method are described, emphasizing the technical aspects and their implications for game security.\r\n\r\n4) Anti-cheat measures\r\n\r\nHere, the focus shifts to the countermeasures implemented by game developers to combat cheating. Encryption is discussed as a means to protect game data and prevent unauthorized access. Client-server validation is explained, involving checks performed between the game client and server to detect inconsistencies and cheating attempts. The role of behavior monitoring systems in identifying suspicious player actions is highlighted. Continuous updates are emphasized as a crucial aspect of anti-cheat measures to patch vulnerabilities and stay ahead of hackers. The discussion also touches on the challenges faced by developers in balancing security measures with player experience.\r\n\r\n5) Future of game hacking\r\n\r\nThe final section explores the future landscape of game hacking within the broader context of information security. I will discuss emerging technologies and trends that may shape game hacking, such as the integration of artificial intelligence and machine learning. The potential impact of blockchain technology on securing in-game economies and preventing cheating is examined. The importance of ongoing research, collaboration among game developers, and the adoption of innovative security measures is emphasized to mitigate evolving threats in the dynamic world of game hacking.", "recording_license": "", "do_not_record": false, "persons": [{"code": "V3QHKR", "name": "James Li", "avatar": null, "biography": "James is currently a security advisor at an insurance company in Montreal. He has worked in the field of both offensive and defensive security. His interest in information security initially developed through video games. Subsequently, he decided to pursue this path by studying Computer Science with a focus on infosec. Along the way, James has obtained various certifications such as OSCP, CISSP, CBBH, etc. He also has a strong interest in game hacking, also known as \"Gamepwn\". This is a relatively lesser-known area within the broader context of information security, and James aims to bring this topic to a wider audience.", "public_name": "James Li", "guid": "7ad386cb-ba29-54af-b763-311edc8116d6", "url": "https://cfp.hackfest.ca/hf2023/speaker/V3QHKR/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/8B3QB8/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/8B3QB8/", "attachments": []}, {"guid": "44d789b0-70d2-554b-83a7-3c10029badd1", "code": "WQMGUN", "id": 233, "logo": null, "date": "2023-10-14T10:00:00-04:00", "start": "10:00", "duration": "00:50", "room": "Track #1", "slug": "hf2023-233-lessons-from-lastpass-beyond-secure-password-management", "url": "https://cfp.hackfest.ca/hf2023/talk/WQMGUN/", "title": "Lessons from LastPass: Beyond Secure Password Management", "subtitle": "", "track": "Defensive", "type": "Regular Talk", "language": "en", "abstract": "LastPass is a popular password manager used from individuals through corporate levels. However, in 2022 it suffered two breaches, and only recently was the extent of the damage made known. An unknown attacker was able to take the literal keys to the kingdom, compromising everything stored in the LastPass vaults. This talk will bring to light why the LastPass events matter to everyone, even those who think they are safe using other password managers or no password managers. There are lessons here about sophisticated staged attacks that bypass defenses in place, and the increasing onus on businesses to manage IAM and BYOD", "description": "We hear it all the time - secure your passwords best with an application dedicated to just that. LastPass is a popular password manager used from individuals through corporate levels. However, in 2022 it suffered two breaches, and only recently was the extent of the damage made known. An unknown attacker was able to take the literal keys to the kingdom, compromising everything stored in the LastPass vaults. We will examine what was made known by LastPass and the media as we walk through the details available on both attacks. We will walk through the timeline of events and disclosures because it's important to note what came to light when, and how that changed the narrative. We will also examine the role played by BYOD, logging, and why we need to change with the times to detect behavoral anomalies.\r\n\r\nThis talk is presented in a \"Lord of the RIngs\" theme\r\nOUTLINE\r\nPassword Managers: What and Why\r\n- What they are and why we need to use them\r\nWhat Could go Wrong\r\n- A timeline of who's been hacked and multiple occurrences\r\n- My personal experience using LastPass and switching to Bitwarden\r\nLastPass: What Did go Wrong\r\n- A basic anatomy of attack and timeline of events to show how what was stolen in Attack 1 was used in Attack 2\r\n- They took both encrypted and unencrypted data\r\n- They took data on browsing habits of users\r\n- The engineer used his own device to access his corporate vault. \r\n- This happens far more than we realize and we cannot effectively secure \r\nA Tale of 2 Attacks\r\n- A detailed discussion of what was discovered against what statements were made by LastPass over the months following the attacks\r\n- Highlight where perceived security failed\r\n- Call out how the crucial time to act at the beginning was lost \r\nKey Takeaways\r\n- Dwell Time matters\r\n- BYOD \u2013 how do you manage\r\n- Leverage logging and alerts\r\n- Track for behaviour and anomalies\r\n- What\u2019s accessible in your dev environment\r\n- Attacks are evolving past our defences", "recording_license": "", "do_not_record": false, "persons": [{"code": "NKNGZL", "name": "Cheryl Biswas", "avatar": null, "biography": "Cheryl Biswas is a Strategic Threat Intel Specialist with a major bank in Canada. She has experience with security audits and assessments, privacy, DRP, project management, vendor management and change management. Cheryl engages in the security community as a conference speaker and volunteer, mentors, and champions women and diversity in Cyber Security as a founding member of the \"The Diana Initiative\".", "public_name": "Cheryl Biswas", "guid": "19321f53-7674-553c-8ea5-96e10a380999", "url": "https://cfp.hackfest.ca/hf2023/speaker/NKNGZL/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/WQMGUN/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/WQMGUN/", "attachments": []}, {"guid": "2cf833eb-828d-5a9c-9299-e03157364124", "code": "XARKMK", "id": 230, "logo": null, "date": "2023-10-14T11:00:00-04:00", "start": "11:00", "duration": "00:50", "room": "Track #1", "slug": "hf2023-230-hacking-reality-countercloud-s-ai-driven-disinformation-campaign", "url": "https://cfp.hackfest.ca/hf2023/talk/XARKMK/", "title": "Hacking Reality: CounterCloud's AI-Driven Disinformation Campaign", "subtitle": "", "track": "Threat Intelligence / OSINT", "type": "Regular Talk", "language": "en", "abstract": "Ever wondered if Skynet could run a fake news empire and win a Pulitzer? This is CounterCloud, a two month online experiment that is part 'Terminator,' part 'Black Mirror,' and takes us deep into the wild frontier of totally autonomous AI-generated disinformation.", "description": "This presentation aims to provide an in-depth exploration of CounterCloud, a groundbreaking autonomous AI system designed to generate and disseminate disinformation. \r\n\r\nPart 1 | \u201cLiar Liar, Pants on Fire.\u201d\r\n\r\nThe talk will kick off with an overview of the current landscape of AI in disinformation campaigns, highlighting specific case studies and limitations. At this point, nearly all AI-based disinformation campaigns require human interaction and support. So, if we could remove as many humans from the equation, the AI system could operate much faster. The presentation will then introduce CounterCloud, from its architecture and technical aspects to its ethical implications and potential risks.\r\n\r\nPart 2 | \u201cDeus Ex Machina\u201d\r\n\r\nThe presentation will then dissect how CounterCloud uses large language models like ChatGPT to autonomously scrape, generate, and distribute disinformation at scale. It will cover the system's architecture, including its backend setup, the role of cloud computing, and the gatekeeper module that decides what content to target. The output capabilities of CounterCloud, such as generating fake articles, comments, images, and social media posts, will also be discussed in detail. \r\n\r\nPart 3 | \u201cThe Wolf at the Door?\u201d\r\n\r\nConcluding the talk, the focus will shift to the public\u2019s response to the experiment. First broken to the public in an article from The Debrief, and also covered by Wired, the presentation will shift to the social reaction to, ethical considerations of, and risks associated with autonomous AI disinformation systems like CounterCloud. Whether one thinks this is awesome tech or the end of the world as we know it, this experiment proves mass AI-powered disinformation is possible. So now what? The presentation will emphasize the need for public awareness, regulatory challenges, and potential ethical solutions to mitigate the risks.", "recording_license": "", "do_not_record": true, "persons": [{"code": "YNRYV7", "name": "MJ Banias", "avatar": null, "biography": "MJ Banias is a journalist, podcaster, and senior intelligence analyst with Sapper Labs Group.", "public_name": "MJ Banias", "guid": "9f2dab10-3583-5288-855d-a9339ff2b20c", "url": "https://cfp.hackfest.ca/hf2023/speaker/YNRYV7/"}, {"code": "JZMKZC", "name": "N", "avatar": null, "biography": null, "public_name": "N", "guid": "6c681acf-52f0-53f5-921e-741d3cc7f10d", "url": "https://cfp.hackfest.ca/hf2023/speaker/JZMKZC/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/XARKMK/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/XARKMK/", "attachments": []}, {"guid": "f340f475-6abb-5015-9545-38096510f217", "code": "MXJBJB", "id": 244, "logo": null, "date": "2023-10-14T13:30:00-04:00", "start": "13:30", "duration": "00:50", "room": "Track #1", "slug": "hf2023-244-enchantment-under-the-c", "url": "https://cfp.hackfest.ca/hf2023/talk/MXJBJB/", "title": "Enchantment under the C", "subtitle": "", "track": "Security Programs/Management", "type": "Regular Talk", "language": "en", "abstract": "How the placement of your security program may be impacting your organization.\r\n\r\nLorraine: Marty, this may seem a little forward, but I was wondering if you would ask me to the Enchantment Under the Sea Dance on Saturday?", "description": "Linda: Yeah Mom, we know, you've told us this story a million times. You felt sorry for him, so you decided to go with him to The Fish Under the Sea Dance.\r\n\r\nLorraine: [thoughtfully, remembering] No, it was The Enchantment Under the Sea Dance. Our first date. I'll never forget, it was the night of that terrible thunderstorm, remember George?\r\n\r\n[He's not listening, completely focused on the show.]\r\n\r\nYour father kissed me for the very first time on that dance floor. It was then I realized I was going to spend the rest of my life with him.\r\n\r\n[Again, George laughs at the show, Marty and Linda exchange a look.]", "recording_license": "", "do_not_record": false, "persons": [{"code": "N97AYA", "name": "Patrick", "avatar": null, "biography": null, "public_name": "Patrick", "guid": "99f747e0-c80a-5867-98fc-ed3f403ff50d", "url": "https://cfp.hackfest.ca/hf2023/speaker/N97AYA/"}, {"code": "QXQZLK", "name": "Kendra Cooley", "avatar": null, "biography": null, "public_name": "Kendra Cooley", "guid": "1c93d713-ed26-5de9-91ef-a8e1f75a8d6b", "url": "https://cfp.hackfest.ca/hf2023/speaker/QXQZLK/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/MXJBJB/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/MXJBJB/", "attachments": []}, {"guid": "f0c344b4-d9df-5029-ae89-910eeb491165", "code": "9MHUNS", "id": 195, "logo": null, "date": "2023-10-14T14:30:00-04:00", "start": "14:30", "duration": "00:50", "room": "Track #1", "slug": "hf2023-195-artificial-intelligence-real-threats", "url": "https://cfp.hackfest.ca/hf2023/talk/9MHUNS/", "title": "Artificial Intelligence / Real Threats", "subtitle": "", "track": "Ai Security", "type": "Regular Talk", "language": "en", "abstract": "A buzzword for years, Artificial intelligence (AI) has evolved into a powerful, accessible tool and, like any tool, it can be used for evil. How can AI technology be harnessed by adversaries (or you) as part of sophisticated information security attacks? What sort of attacks are we seeing in the wild and how can we prepare for the new offensive techniques?", "description": "After the initial Title and Introduction slides the presentation: \r\n- Layout: Talking about what we are talking about. Giving the audience the basic layout of the talk and what we'll be covering. All high level info but sets expectations for the talk. \r\n- History: Recapping how we got to this point and our (new) problem. \r\n- Video: Covering video AI technology, real world attacks examples, and means to leverage the tech to prepare for attacks. \r\n- Audio: Covering audio (voice) AI technology, real world attacks examples, and means to leverage the tech to prepare for attacks. \r\n- Text/Code: Covering the use of text AI in social engineering attacks and development efforts.\r\n- Recap: Running over the key takeaways again in the hope that something sticks.\r\n- Thanks + A fun Q&A", "recording_license": "", "do_not_record": false, "persons": [{"code": "F7W7YF", "name": "Johnny Xmas", "avatar": null, "biography": null, "public_name": "Johnny Xmas", "guid": "27c1d1f5-cf0a-57fa-a5de-d8bb853f6a02", "url": "https://cfp.hackfest.ca/hf2023/speaker/F7W7YF/"}, {"code": "ERHSTX", "name": "Chris Carlis", "avatar": null, "biography": "Chris Carlis is an unrepentant penetration tester with an extensive background in network, wireless and physical testing. Across his career, Chris has worked to expand the value offensive testing provided via open communication and goal driven engagements. These experiences lead Chris to co-found Dolos Group with a focus on Red/Purple Teaming, security education and training. Additionally, Chris has presented at a variety of conferences, including Thotcon, Hushcon, Hackfest, FS-ISAC, and various B-Side events. He is a perennial volunteer at the Thotcon conference in his native Chicago and helps to organize multiple Chicagoland \u201cBurbSec\u201d information security monthly gatherings.", "public_name": "Chris Carlis", "guid": "6c2d6bfb-d4cd-579f-9278-9c34764c178a", "url": "https://cfp.hackfest.ca/hf2023/speaker/ERHSTX/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/9MHUNS/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/9MHUNS/", "attachments": []}, {"guid": "73a0bdcc-6b3b-5b5e-a10a-bd92a9df65be", "code": "BHXGYC", "id": 209, "logo": "https://cfp.hackfest.ca/media/hf2023/images/BHXGYC/1626989466489_hinO39U.jpeg", "date": "2023-10-14T15:30:00-04:00", "start": "15:30", "duration": "00:50", "room": "Track #1", "slug": "hf2023-209-cloud-environments-red-team-perspectives", "url": "https://cfp.hackfest.ca/hf2023/talk/BHXGYC/", "title": "Cloud environments: Red Team perspectives", "subtitle": "", "track": "Offensive", "type": "Regular Talk", "language": "fr", "abstract": "This presentation delves into the realm of cloud computing's security challenges and the Red Team perspective. It sheds light on intrusion testing, shared security models, and vulnerabilities unique to cloud systems. The discussion covers cloud intrusion testing's importance, methodologies, and distinctiveness compared to traditional approaches. Identity and Access Management's crucial role will be highlighted and explain through the 3 main CSP AWS/Azure/GCP, their main differences and security implication. The talk will outlines reasons for conducting Red Team engagements focusing on critical resource access. Applied assessment methodologies are proposed, including BlackBox, AssumBreach, and White Box approaches. Attack scenarios, based on the Mitre Att&ck Cloud Matrix framework, are explored, encompassing various stages. The presentation also delves into using the cloud offensively (Redirectors, storage and delivery), cloud-based phishing and Oauth abuse. The aim is to facilitate knowledge exchange, encourage research, and enhance cloud security by leveraging Red Team insights.", "description": "Cloud computing has become an integral part of modern infrastructure, offering scalable and flexible solutions for businesses. However, this new paradigm brings its own set of security challenges. This presentation aims to explore the Red Team perspectives in cloud environments, focusing on various aspects such as intrusion testing, shared security models, and the unique vulnerabilities and attack vectors associated with cloud-based systems (AWS/GCP/Azure).\r\n\r\nThis presentation will introduce the concept of cloud intrusion testing and its significance in today's technological landscape, from the perspective of an attacker or Red Team operator. Standards and frameworks will be discussed to provide a comprehensive understanding of its purpose, objectives, and main differences compared to more classic approaches such as network, web application, mobile, and wireless intrusion testing. Emphasis will be placed on the heavy reliance on Identity and Access Management (IAM) as a crucial factor in enabling or restricting actions within cloud environments. \r\n\r\nThe reasons for conducting intrusion tests and Red Team engagements in cloud environments will be outlined, highlighting similar attack surfaces to web applications or external networks. Additionally, the potential access to critical resources will be addressed, including development pipelines, CI/CD systems, sensitive data backups or storage, user accounts synchronized with on-premise domains, synchronization with on-premise Active Directory servers, and management of devices and computers through services like Azure Hybrid Joined and Intune.\r\n\r\nFurthermore, applied methodologies for assessing and testing the security posture of cloud environments will be proposed, offering three distinct approaches or positions: BlackBox, AssumBreach, and White Box. These approaches will provide the audience with practical guidance on how to approach cloud environment assessments and intrusion testing engagements.\r\n\r\nSubsequently, TTPs (Tactics, Techniques, and Procedures) and attack scenarios based on the Mitre Att&ck Cloud Matrix framework will be presented, covering enumeration/discovery, initial access, persistence, and impact. Examples will range from password spray limitation bypass to S3 Ransomware detonation.\r\n\r\nExpanding the scope of the discussion, the concept of the cloud as an offensive tool in Red Team operations and social engineering will be explored. Examples of cloud-based phishing approaches and the offensive use of cloud resources will be presented.\r\n\r\nFinally, the emerging field of Purple Team within the cloud environment will be briefly touched upon. Collaborative approaches that bring together Red and Blue Teams to enhance cloud security will be discussed.", "recording_license": "", "do_not_record": false, "persons": [{"code": "ZXURNG", "name": "Cl\u00e9ment Cruchet", "avatar": null, "biography": "Cl\u00e9ment is a passionate speaker and technical security expert, specializing in security testing, offensive security and ethical hacking. Currently technical team leader for security testing and offensive security practice at Bell Canada, he is driven by an unwavering passion for security and hacking. Cl\u00e9ment has carried out numerous assignments and assessments for clients in various sectors such as banking, finance, government, services, industry and energy. Endowed with an insatiable curiosity and unfailing tenacity, Cl\u00e9ment is a passionate hacker who constantly seeks to understand the architecture and fundamentals of the technologies that come his way.", "public_name": "Cl\u00e9ment Cruchet", "guid": "de9d3404-7233-5147-aa9e-8dafc015cad3", "url": "https://cfp.hackfest.ca/hf2023/speaker/ZXURNG/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/BHXGYC/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/BHXGYC/", "attachments": []}, {"guid": "0f0bff6b-f6e0-50c6-be33-c357a628c42d", "code": "KBCULM", "id": 194, "logo": null, "date": "2023-10-14T16:30:00-04:00", "start": "16:30", "duration": "00:20", "room": "Track #1", "slug": "hf2023-194-smart-contracts-not-so-smart-bugs-crypto-domain-takeovers", "url": "https://cfp.hackfest.ca/hf2023/talk/KBCULM/", "title": "Smart Contracts, Not So Smart Bugs: Crypto Domain Takeovers", "subtitle": "", "track": "Offensive", "type": "Speed Talk", "language": "en", "abstract": "Web 3.0 smart contracts, like the ones found on Ethereum, bring promises of speed, decentralization, and security. Although DeFi's model may seem complex, these projects still can be vulnerable to relatively simple attacks like domain takeovers. In this beginner-friendly talk, we discuss how I discovered dangling DNS on several decentralized crypto exchanges and my experiences trying to responsibly disclose vulnerabilities to them.", "description": "Introduction to Dexs (Decentralized Exchanges)\r\n- What are some of the largest Dexs and why are they used? \r\n\t- Uniswap, PancakeSwap, Sushiswap all allow users to trade tokens without having to use a centralized intermediary like Coinbase or Kraken\r\n\t- Users might not want to KYC (share identity) or want to purchase a token that's not listed on an exchange (HarryPotterObamaSonic10Inu)\r\n\t- These organizations are often DAOs (decentralized autonomous organizations) and so development is public on Github.\r\n- What does the user experience look like?\r\n\t- Metamask - prompt to approve tokens, then approve to swap.\r\n\r\nIntroduction to NextJS / Vercel\r\n- Many projects in the space are using the NextJS Javascript framework because it integrates well with common Web3 libraries (like Ethers.js)\r\n- Vercel is a product from NextJS that is something like a CI/CD pipeline for a frontend\r\n\t\t- Each pull request gets a preview deployment\r\n\t\t- Changes merged to main get a production deployment\r\n\r\nDiscovering Vulnerability #1 - Vercel Bugs\r\n- March 2022: A bug in Vercel allowed an attacker to drain $320.000 from EVODeFi, so I began investigating how this might have happened\r\n- It turned out many crypto projects were using Vercel so I decided to take a closer look. If a malicious user took over a Dex, it would be trivial to trick users into approving malicious contracts.\r\n- YearnFi - linked to a Vercel deployment in their Github repositories.\r\n\t- I took over crv.ape.tax; yearn-hub.vercel.app; other deployment URLS\r\n\t- Reward: $500 DAI (had to reach out on Keybase, ImmuneFi did not help)\r\n- Uniswap\r\n\t- Took over uniswap-frontend-beta.vercel.app\r\n\t- No reward\r\n- Sushiswap\r\n\t- Took over full domain of Sushiswap.fi and was able to increase impact by adding mail records\r\n\t- Reward: 100 Sushi not from the foundation, unofficially via Discord\r\n- *.finance\r\n\t- Since most DeFi sites used finance domains, I scanned the entire zone file for dangling Vercel domains. \r\n\t- Took over domains of some defunct projects. Unable to return these to their rightful owners.\r\n\r\nDiscovering Vulnerability #2 - Onename\r\n- Onename.io was used to translate user handles into Bitcoin addresses\r\n- Previously hosted on Heroku - DNS was dangling so it was able to be taken over\r\n- Many high profile twitter users had linked to this service, including crypto CEOs. As an attacker this would be extremely useful for phishing.\r\n- Reported to HackerOne: $100 bounty\r\n\r\nConclusion\r\n- Just start hunting and learning - these bugs did not require uber 1337 hacking skills\r\n- Think about your threat model - don't get stuck thinking of the most complicated exploit scenario when dangling DNS is simple yet impactful\r\n- Crypto and Infosec people should talk more instead of fighting with each other :)", "recording_license": "", "do_not_record": true, "persons": [{"code": "ZFUWEH", "name": "Michael Be", "avatar": null, "biography": "Red Team Manager and Crypto Enthusiast", "public_name": "Michael Be", "guid": "5db4dfa1-df11-570e-8a5f-31f9bd67672a", "url": "https://cfp.hackfest.ca/hf2023/speaker/ZFUWEH/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/KBCULM/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/KBCULM/", "attachments": []}, {"guid": "e95ba949-8966-5051-8a9b-dd387b45a33f", "code": "WVDD9Y", "id": 237, "logo": null, "date": "2023-10-14T17:00:00-04:00", "start": "17:00", "duration": "00:50", "room": "Track #1", "slug": "hf2023-237-hackfest-closing-ceremony", "url": "https://cfp.hackfest.ca/hf2023/talk/WVDD9Y/", "title": "Hackfest Closing Ceremony", "subtitle": "", "track": null, "type": "Regular Talk", "language": "en", "abstract": "Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc. Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.", "description": "Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activit\u00e9es, remises des prix, black coins, etc.", "recording_license": "", "do_not_record": false, "persons": [{"code": "LA3MTX", "name": "Hackfest Communication", "avatar": null, "biography": null, "public_name": "Hackfest Communication", "guid": "6b885b5a-8f36-5288-8209-f1c6cbb092a7", "url": "https://cfp.hackfest.ca/hf2023/speaker/LA3MTX/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/WVDD9Y/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/WVDD9Y/", "attachments": []}], "Track #2": [{"guid": "b86885c2-eaea-5036-b323-880ad3304340", "code": "SKGTQ9", "id": 198, "logo": null, "date": "2023-10-14T09:00:00-04:00", "start": "09:00", "duration": "00:50", "room": "Track #2", "slug": "hf2023-198-la-meilleure-cyberdefense-c-est-l-att-ck", "url": "https://cfp.hackfest.ca/hf2023/talk/SKGTQ9/", "title": "La meilleure cyberd\u00e9fense, c'est l'ATT&CK\u00ae", "subtitle": "", "track": "Security 101", "type": "Regular Talk", "language": "fr", "abstract": "Outillez votre cyberd\u00e9fense en apprenant \u00e0 naviguer dans la matrice des tactiques et techniques utilis\u00e9es par les cybercriminels et leurs \u00e9cosyst\u00e8mes !\r\n\r\nCette pr\u00e9sentation est con\u00e7ue tant pour les gestionnaires que les professionnels de la cybers\u00e9curit\u00e9 et de la gouvernance de la s\u00e9curit\u00e9 de l'information souhaitant d\u00e9velopper leurs connaissances du domaine des op\u00e9rations de cybers\u00e9curit\u00e9 en commen\u00e7ant par les plus jeunes \u00e0 qui je parlerai du programme MITRE ATT&CK Defender\u2122 (MAD) ATT&CK\u00ae.\r\n\r\nAu fil des ans, le MITRE ATT&CK\u00ae s'est immisc\u00e9 dans les op\u00e9rations de cybers\u00e9curit\u00e9 au point de devenir un standard de facto. Mais de quoi s'agit-il ?\r\n\r\nApprenez comment op\u00e9rationnaliser ce qui n\u2019est ni un produit ni une technologie dans les pratiques de cyberenseignement (CTI), chasse aux cybermenaces (TH) et simulations de cyberattaques (AE) ou encore comment renforcer la valeur du centre de gestion des op\u00e9rations de cybers\u00e9curit\u00e9 (SOC). \r\n\r\nEnfin, que vous disposiez de l'expertise ou que vous fassiez appel \u00e0 un fournisseur de services g\u00e9r\u00e9s, d\u00e9couvrez comment int\u00e9grer l'approche MITRE ATT&CK\u00ae dans votre strat\u00e9gie globale de s\u00e9curit\u00e9 de l'information en \u00e9valuant votre posture de cyberd\u00e9fense afin d'aligner vos contr\u00f4les avec les m\u00e9canismes de d\u00e9tection et de r\u00e9ponse requis.", "description": "Outillez votre cyberd\u00e9fense en apprenant \u00e0 naviguer dans la matrice des tactiques et techniques utilis\u00e9es par les cybercriminels et leurs \u00e9cosyst\u00e8mes !\r\n\r\nCette pr\u00e9sentation int\u00e9ressera autant les gestionnaires que les professionnels de la cybers\u00e9curit\u00e9 et de la gouvernance de la s\u00e9curit\u00e9 de l'information souhaitant d\u00e9velopper leurs connaissances du domaine des op\u00e9rations de cybers\u00e9curit\u00e9.\r\n\r\nDepuis ces derni\u00e8res ann\u00e9es, le MITRE ATT&CK\u00ae s'est immisc\u00e9 dans les op\u00e9rations de cybers\u00e9curit\u00e9 au point de devenir un standard de facto.\r\n\r\nLes \u00e9diteurs de solutions de cybers\u00e9curit\u00e9 l\u2019ont compris et int\u00e8grent de plus en plus cette approche dans leurs produits.\r\n\r\nQu\u2019en est-il de vos pratiques de cybers\u00e9curit\u00e9 ou de celles de votre fournisseur de services cybers\u00e9curit\u00e9 g\u00e9r\u00e9s ?\r\n\r\nQue vous soyez impliqu\u00e9 dans la cybers\u00e9curit\u00e9 offensive ou d\u00e9fensive, apprenez comment penser comme un pirate informatique, comprendre sa motivation, ses actions et ses outils avec l\u2019approche MITRE ATT&CK\u00ae et D3FEND\u00ae.\r\n\r\nQue vous fassiez partie d\u2019une grande entreprise ou d\u2019une PME, prenez conscience de l\u2019importance de connaitre les faiblesses de votre cyberd\u00e9fense, et d\u2019identifier vos besoins afin d\u2019acqu\u00e9rir les technologies appropri\u00e9es pour y r\u00e9pondre.\r\n\r\nQue vous disposiez des ressources ou que vous fassiez appel \u00e0 un fournisseur de services g\u00e9r\u00e9s en cybers\u00e9curit\u00e9, d\u00e9couvrez comment vous assurer de disposer de l\u2019expertise ou des services pour d\u00e9tecter et de r\u00e9pondre aux incidents selon votre contexte.\r\n\r\nLevez le voile sur l\u2019op\u00e9rationnalisation de ce qui n\u2019est ni un produit ni une technologie dans les pratiques de cyberenseignement (CTI), chasse aux cybermenaces (TH) et simulations de cyberattaques (AE) ou encore comment renforcer la valeur du centre de gestion des op\u00e9rations de cybers\u00e9curit\u00e9 (SOC).\r\n\r\nClarifier l\u2019int\u00e9gration de l'approche MITRE ATT&CK\u00ae dans votre strat\u00e9gie globale de s\u00e9curit\u00e9 de l'information en \u00e9valuant votre posture de cyberd\u00e9fense afin d'aligner vos contr\u00f4les avec les m\u00e9canismes de d\u00e9tection et de r\u00e9ponse requis.\r\n\r\nEnfin, appropriez-vous l\u2019\u00e9cosyst\u00e8me en ligne et les nombreuses ressources disponibles pour vous former ou vous faire certifier dans le cadre du programme MITRE ATT&CK Defender\u2122 (MAD).", "recording_license": "", "do_not_record": false, "persons": [{"code": "NMXY9U", "name": "Christophe Reverd", "avatar": null, "biography": "Christophe Reverd a occup\u00e9 des postes de direction dans les op\u00e9rations de cybers\u00e9curit\u00e9 (centre des op\u00e9rations de cybers\u00e9curit\u00e9, r\u00e9ponse aux incidents de criminalistique num\u00e9rique, renseignement sur les cybermenaces, chasse aux cybermenaces, gestion des actifs et des vuln\u00e9rabilit\u00e9s, tests d'intrusion) avant de diriger la fonction s\u00e9curit\u00e9 (RSI) pour Quincaillerie Richelieu Lt\u00e9e (TSX:RCH) dont les op\u00e9rations de distribution s'\u00e9tendent en Am\u00e9rique du Nord.\r\n\r\nTitulaire d\u2019une ma\u00eetrise en administration, concentration gouvernance, audit et s\u00e9curit\u00e9 des technologies de l'information (TI) de l\u2019Universit\u00e9 de Sherbrooke, Christophe est \u00e9galement d\u00e9tenteur de certifications professionnelles en gestion de la s\u00e9curit\u00e9 de l\u2019information (CISSP-ISSMP), audit TI (CISA), gouvernance TI (CGEIT), risque TI (CRISC), MITRE ATT&CK (SOC, CTI, AE, THDE, PTM) et infonuagique (Microsoft Azure).\r\n\r\nSa passion \u00e0 promouvoir les technologies \u00e9mergentes a pris une nouvelle dimension par son implication en \u00e9ducation o\u00f9 il a inculqu\u00e9 les meilleures pratiques en tant que charg\u00e9 de cours en gouvernance des TI \u00e0 l\u2019\u00c9cole de gestion pendant dix ans et en cyber s\u00e9curit\u00e9 au Centre de formation des TI (CEFTI) de la Facult\u00e9 des Sciences de l\u2019Universit\u00e9 de Sherbrooke, parall\u00e8lement \u00e0 son parcours professionnel.", "public_name": "Christophe Reverd", "guid": "3411cadd-51ac-5f58-8822-78100c050223", "url": "https://cfp.hackfest.ca/hf2023/speaker/NMXY9U/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/SKGTQ9/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/SKGTQ9/", "attachments": []}, {"guid": "34cecc90-fa8b-5c8c-8ce4-f43f33acec5a", "code": "XRQDEH", "id": 219, "logo": null, "date": "2023-10-14T10:00:00-04:00", "start": "10:00", "duration": "00:50", "room": "Track #2", "slug": "hf2023-219-between-a-log-and-a-hard-place-mis-adventures-in-azure-logs", "url": "https://cfp.hackfest.ca/hf2023/talk/XRQDEH/", "title": "Between a Log and a Hard Place: (mis)Adventures in Azure Logs", "subtitle": "", "track": "Defensive", "type": "Regular Talk", "language": "en", "abstract": "Security monitoring in any environment is made or broken by the signal quality in the event logs. With mass migration to the cloud, defenders are putting all of their logging capability \"eggs\" in one provider's \"basket\". This works when the logging facilities are well designed and work robustly, but what do you do when issues arise?\r\n\r\nIn this talk, we will examine logging facilities in Azure (concentrating on events generated by Azure AD and Microsoft 365) and discuss multiple problems that we have observed in monitoring them. \r\n \r\nThese include: \r\n- Blind spots hiding critical security events\r\n- Poorly documented events, attributes and magic values \r\n- Missing important information about user actions\r\n- Bugs in log records \r\n- Unannounced changes that break detection queries\r\n- Log pollution opportunities, potentially leading to RCE \r\n- and more \r\n\r\nWe will examine impact of these issues on defense and monitoring, opportunities for red-teamers, and the ways the cloud provider can address the problems going forward.", "description": "Security monitoring in any environment is made or broken by the signal quality in the event logs.\r\n\r\nCloud-based solutions have transformed the computing landscape with advantages like on-demand resource availability, scalability, cost-effectiveness, and enhanced collaboration capabilities. For defenders, this new world offered many benefits: robust identity management, patching at scale, improved incident detection and response, and more. \r\nCloud providers expose detailed logs that are consumed by security monitoring tools and SOC analysts. One would expect a common, streamlined logging solution to be a clear win in attack detection functionality, but the reality is more complicated. \r\n\r\nWe have spent the last three years studying and monitoring Azure logs and have seen many problems that can complicate incident detection and response. With no alternatives to the provider's logging solution and slow problem mitigation speed, these issues go beyond mere annoyances and can help attackers avoid detection. \r\n\r\nIn this talk, we will examine logging facilities in Azure, concentrating on events generated by Azure AD and Microsoft 365, and discuss multiple problems that we have observed in monitoring them. \r\n \r\nThese include: \r\n- Blind spots hiding critical security events\r\n- Poorly documented events, attributes and magic values \r\n- Missing important information about user actions\r\n- Bugs in log records \r\n- Unannounced changes that break detection queries\r\n- Log pollution opportunities, potentially leading to RCE \r\n- and more \r\n \r\nFor all these issues, we will: \r\n- examine their impact on defense and monitoring \r\n- discuss how attackers (and red teamers) may take advantage of them \r\n- suggest how defenders can mitigate the negative impact, where possible \r\n- and propose ways the cloud provider can address the problems going forward", "recording_license": "", "do_not_record": false, "persons": [{"code": "CKSUDS", "name": "Dmitriy Beryoza", "avatar": null, "biography": "Dmitriy Beryoza is a Senior Security Researcher with Vectra AI, working on threat detection in the cloud and on-prem networks.\r\n\r\nBefore that he was a penetration tester and secure software development advocate at IBM. He has been a software developer for many years, before switching to security full-time.\r\n\r\nDmitriy presented talks at security conferences such as DEF CON Cloud Village, HackFest, BSides, and others.\r\n\r\nHis interests include reverse engineering, secure software development, and CTF competitions.", "public_name": "Dmitriy Beryoza", "guid": "e8393275-3318-5d8c-bd37-b63f57cdb53b", "url": "https://cfp.hackfest.ca/hf2023/speaker/CKSUDS/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/XRQDEH/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/XRQDEH/", "attachments": []}, {"guid": "c0344387-89e7-5cf9-a7e7-af079a2185cc", "code": "Y8VWXL", "id": 180, "logo": null, "date": "2023-10-14T11:00:00-04:00", "start": "11:00", "duration": "00:50", "room": "Track #2", "slug": "hf2023-180-it-was-harder-to-sniff-bluetooth-through-my-mask-during-the-pandemic", "url": "https://cfp.hackfest.ca/hf2023/talk/Y8VWXL/", "title": "It was harder to sniff Bluetooth through my mask during the pandemic...", "subtitle": "", "track": "Hardware/IoT", "type": "Regular Talk", "language": "en", "abstract": "During the pandemic I took up Bluetooth (BT) sniffing as a way to get out of the house. \r\n\r\nBluedriving left me with questions that are different from those you'd ask based on traditional WiFi wardriving. Is there a geographic correlation between poverty, obesity, and BT sleep apnea medical devices? What are the implications of BT on police body cameras? Are fitness trackers still making it easy to track humans instead? Can someone steal heavy-construction equipment thanks to BT keyless ignition? Can hackers be tracked by their \"portable multi-tool[s]\"? Do hotels using BT door locks \"open the door\" to easier assassinations?\r\n\r\nIn this talk I will share some of the most interesting observations from the past few years, and share surprising answers to the above questions, and more.", "description": "Quisque et neque a est gravida venenatis. Nullam finibus diam tellus, quis tristique ligula hendrerit eu. Cras ante justo, ornare euismod rhoncus non, dictum vitae ipsum. Sed sit amet molestie sapien. Curabitur eu quam quis massa venenatis convallis. Sed sit amet magna quis sem venenatis molestie. Proin id urna dolor. Pellentesque at tempor orci, quis faucibus elit. Duis gravida eu mi non euismod. Donec sit amet erat sed ante varius egestas nec eget dolor. Ut imperdiet enim maximus mi euismod, vel tincidunt sem blandit. Phasellus a fermentum est. Donec scelerisque felis nec lobortis sagittis. Nulla diam dui, sagittis non turpis.", "recording_license": "", "do_not_record": false, "persons": [{"code": "TVLF3N", "name": "Xeno Kovah", "avatar": null, "biography": "Prior to working full time on OpenSecurityTraining2 (ost2.fyi), Xeno worked at Apple designing architectural support for firmware security; and code auditing firmware security implementations. A lot of what he did revolved around adding secure boot support to the main and peripheral processors (e.g. the Broadcom Bluetooth chip.) He led the efforts to bring secure boot to Macs, first with T2-based Macs, and then with the massive architectural change of Apple Silicon Macs. Once the M1 Macs shipped, he left Apple to pursue the project he felt would be most impactful: creating free deep-technical online training material and growing the newly created OpenSecurityTraining 501(c)(3) nonprofit.", "public_name": "Xeno Kovah", "guid": "a91f23aa-568a-5607-a29c-67b202a1ea38", "url": "https://cfp.hackfest.ca/hf2023/speaker/TVLF3N/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/Y8VWXL/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/Y8VWXL/", "attachments": []}, {"guid": "d188f47f-bb5f-55f0-9899-599f26d8b696", "code": "8ZYFHT", "id": 189, "logo": null, "date": "2023-10-14T13:30:00-04:00", "start": "13:30", "duration": "00:50", "room": "Track #2", "slug": "hf2023-189-noth1ng-t0-hid3", "url": "https://cfp.hackfest.ca/hf2023/talk/8ZYFHT/", "title": "NOTH1NG T0 HID3", "subtitle": "", "track": "Privacy", "type": "Regular Talk", "language": "en", "abstract": "This talk revisits the theme of personal privacy in the digital world, this time centring around the \"I've got nothing to hide\" argument. A beam of intensive light is shed on the motivation behind caring about one's privacy. We go in depth into what we can do to stay private and should we even try to do it at all. We talk about where we as an global society were able to fix privacy and where we have failed. New topics previously not covered are discussed, such as AI/LLMs.", "description": "1. Confusion of the inverse logical fallacy (all criminal activity is hidden, so all that is hidden must be criminal).\r\n1a. Schr\u00f6dinger's video camera\r\n2. Why is privacy important (actual rebuttals to \"if you're doing nothing wrong, you've got nothing to hide\")\r\n2a. Data hoarding \u2192 Blackmail, impersonation\r\n2b. Today\u2019s authority might become totalitarian or inhumane\r\n2c. Herd immunity: many people not hiding anything, make the few stand out more and cause (misplaced) suspicion\r\n3. What do \"normal people\" have to say? What reactions have I've been getting since my previous version of the talk on a similar topic?\r\n4. Real examples of privacy nightmares.\r\n4a. China & Hong Kong (all the weird stuff)\r\n4b. Facebook (court rulings, suicide prevention algorithm)\r\n4c. EU (cookies, GPDR)\r\n4d. UK\r\n5. The end of end-to-end encryption\r\n6. Stories from the privacy zealot (How to achieve privacy and how much it cost me)\r\n6a. Mobile apps\r\n6b. IT certification exams\r\n6c. Airport scanners\r\n6x. more examples to follow\r\n7. Specific examples of where we were able to fix privacy\r\n7a. And where we failed (this is sadly larger than (6))\r\n8. Summary \u2014 do we fix it or what?", "recording_license": "", "do_not_record": false, "persons": [{"code": "FRZKR3", "name": "Kirils Solovjovs", "avatar": null, "biography": "Kirils Solovjovs is an IT policy activist, bug bounty hunter, and the most visible white-hat hacker in Latvia having discovered and responsibly disclosed or reported multiple security vulnerabilities in information systems of both national and international significance. He has extensive experience in social engineering, penetration testing, network flow analysis, reverse engineering, and the legal dimension.\r\n\r\nHe has developed the jailbreak tool for Mikrotik RouterOS, as well as created e-Saeima, helping the Latvian Parliament become the first parliament in the world that is prepared for a fully remote legislative process. He has spoken at many amazing conferences including Hack In The Box, Hack in Paris, TyphoonCon, MCH2022, 35C3, CONFidence, BalCCon, Nullcon, and of course Hackfest.", "public_name": "Kirils Solovjovs", "guid": "60d34ff6-7be5-5eaf-bab3-484763e8ebb9", "url": "https://cfp.hackfest.ca/hf2023/speaker/FRZKR3/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/8ZYFHT/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/8ZYFHT/", "attachments": []}, {"guid": "a8619a81-3cd7-59c5-a1b2-5ccb1b7486b9", "code": "K7SXNK", "id": 208, "logo": null, "date": "2023-10-14T14:30:00-04:00", "start": "14:30", "duration": "00:50", "room": "Track #2", "slug": "hf2023-208-des-pilules-pour-maigrir-l-osint-pour-demasquer-un-reseau-international-de-fraude-en-ligne", "url": "https://cfp.hackfest.ca/hf2023/talk/K7SXNK/", "title": "Des pilules pour maigrir? L\u2019OSINT pour d\u00e9masquer un r\u00e9seau international de fraude en ligne", "subtitle": "", "track": "Threat Intelligence / OSINT", "type": "Regular Talk", "language": "fr", "abstract": "On trouve sur Facebook des annonces ou des vedettes qu\u00e9b\u00e9coises semblent faire la promotion de pilules pour perdre du poids sans efforts ou encore \u00ab avoir des \u00e9rections comme dans 18 ans \u00bb! Malheureusement, des gens tombent dans le panneau et \u00e7a peut leur co\u00fbter cher. \r\n\r\nL\u2019\u00e9mission d\u2019enqu\u00eate J.E. nous a demand\u00e9 de l\u2019aide pour d\u00e9nicher les responsables de ces arnaques. \u00c0 l\u2019aide du Cycle du renseignement nous allons explorer les bases de l\u2019OSINT. Nous verrons ce que c\u2019est et ce que ce n\u2019est pas, ainsi que les pr\u00e9cautions \u00e0 prendre durant ce type d\u2019enqu\u00eate.\r\n\r\nUn stratag\u00e8me comme celui-ci n\u00e9cessite plusieurs acteurs. Nous montrerons les \u00e9tapes qui ont men\u00e9 \u00e0 la cartographie du r\u00e9seau, \u00e0 l\u2019identification de certaines personnes impliqu\u00e9es et comment la photo d'un chien nous a mis sur la piste de son adresse.", "description": "La pr\u00e9sentation se veut une introduction \u00e0 l\u2019OSINT et une d\u00e9monstration d\u2019une enqu\u00eate effectu\u00e9e pour une \u00e9mission journalistique. \r\n\r\nIntro : Gino Chouinard vend des pilules ?!?\r\n\r\nL\u2019\u00e9quipe de l\u2019\u00e9mission d\u2019enqu\u00eate J.E. de TVA nous a approch\u00e9s pour les aider \u00e0 d\u00e9nicher les responsables d\u2019une campagne de fraude qui utilise l\u2019image de vedettes de l\u2019empire Qu\u00e9becor pour votre des pilules. Ces annonces sont diffus\u00e9es via Facebook et renvoient vers des pages h\u00e9berg\u00e9es sur des sites Web clon\u00e9s. Ces sites Web envoient ensuite les visiteurs vers une multitude de magasins en ligne qui proposent des produits amaigrissants, des produits naturels et autres. Lorsqu\u2019on ach\u00e8te un produit sur ces sites, on s\u2019en fait envoyer plus que ce qu\u2019on a demand\u00e9 et les factures gonflent rapidement.\r\n\r\nEn introduction, je veux donc exposer les grandes lignes de la fraude.\r\n\r\n1: Le Cycle du renseignement ou comment ne pas se perdre dans les terriers de lapin.\r\n\r\nLa diff\u00e9rence entre l\u2019OSINT et \u00ab fouiller sur Google \u00bb c\u2019est le Cycle du renseignement. D\u00e9buter avec une question claire et un plan pour y r\u00e9pondre permet de ne pas se perdre. Ce concept qui vient du renseignement est utile pour l\u2019OSINT dans toute sorte de contextes, que ce soit en threat-hunting, en journalisme ou dans un CTF.\r\n\r\n2: C\u2019est quoi l\u2019OSINT ?\r\n\r\nL'OSINT, c\u2019est du renseignement de sources ouvertes. C\u2019est une m\u00e9thode de travail passive et \u00ab sans contact \u00bb. On ne laisse rien derri\u00e8re et on ne prend que des \u00ab screenshots \u00bb.\r\n\r\nL\u2019OSINT regroupe plusieurs sous-sp\u00e9cialit\u00e9s : les r\u00e9seaux sociaux, la g\u00e9olocalisation, les transports a\u00e9riens, maritimes et autres, les enqu\u00eates sur les personnes ou les entreprises, les infrastructures r\u00e9seau.\r\n\r\nIl y a quelques pr\u00e9cautions \u00e0 prendre avant de se lancer dans ce genre d\u2019enqu\u00eate. Nous allons aborder celles-ci de fa\u00e7on rapide : \u00ab sock puppets \u00bb, VPN, machine virtuelle, prise de notes et pr\u00e9servation de l\u2019information.\r\n\r\n3: Qui se cache derri\u00e8re ces annonces ?\r\n\r\n\u00c0 l\u2019aide des donn\u00e9es obtenues de la part de personnes ayant \u00e9t\u00e9 fraud\u00e9es, nous avons cartographi\u00e9 le r\u00e9seau utilis\u00e9 pour ce stratag\u00e8me : les sites Web, les serveurs, les entreprises, les individus.\r\n\r\nL\u2019op\u00e9ration a pu \u00eatre divis\u00e9e en deux grands groupes. D\u2019un c\u00f4t\u00e9, un r\u00e9seau de sites Web servant \u00e0 pousser des annonces frauduleuses sur Facebook et diriger du trafic vers des magasins en ligne. De l\u2019autre, le r\u00e9seau de magasins en ligne, \u00e0 l\u2019apparence ind\u00e9pendants, mais tous li\u00e9s les uns aux autres.\r\n\r\nGr\u00e2ce \u00e0 une petite erreur de sa part, nous avons r\u00e9ussi \u00e0 relier le premier pan de cette op\u00e9ration \u00e0 un individu. Une photo de son chien nous a finalement mis sur la piste de son adresse de r\u00e9sidence.\r\n\r\n4: Conclusion\r\n\r\nLes participants et participants \u00e0 cette conf\u00e9rence en sortiront avec une meilleure compr\u00e9hension de l\u2019OSINT et de son application. Ils comprendront l\u2019importance du cycle du renseignement pour structurer la recherche et travailler de fa\u00e7on efficace.", "recording_license": "", "do_not_record": false, "persons": [{"code": "VZZANR", "name": "Sam Harper", "avatar": null, "biography": "Sam Harper est un m\u00e9decin de famille d\u00e9froqu\u00e9 qui a d\u00e9couvert le journalisme apr\u00e8s un d\u00e9tour en informatique.\r\nIl est journaliste d'enqu\u00eate pour Pivot, un m\u00e9dia ind\u00e9pendant. Il a cofond\u00e9 l'organisme Cyber Citoyen, un organisme qui fait de la vulgarisation et de la formation autour des enjeux de vie priv\u00e9e et de s\u00e9curit\u00e9 et qui accompagne les personnes victimes de violence technologique.", "public_name": "Sam Harper", "guid": "3f900e30-33bc-51ae-8468-226ebcf08c4e", "url": "https://cfp.hackfest.ca/hf2023/speaker/VZZANR/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/K7SXNK/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/K7SXNK/", "attachments": []}], "Workshops & Speed": [{"guid": "8159b2be-855e-5e48-bb3d-150eace1ecc4", "code": "7FMB8N", "id": 236, "logo": null, "date": "2023-10-14T10:00:00-04:00", "start": "10:00", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-236-web-scraping-unleashed-mastering-techniques-for-data-harvesting", "url": "https://cfp.hackfest.ca/hf2023/talk/7FMB8N/", "title": "Web Scraping Unleashed: Mastering Techniques for Data Harvesting", "subtitle": "", "track": "Offensive", "type": "Speed Talk", "language": "en", "abstract": "This talk offers a concise introduction to web scraping techniques using Python, focusing on automated data extraction from websites. Web scraping enables the systematic collection of web data for various purposes, including content aggregation, research, job hunting, social media analysis, and monitoring legal and compliance issues. It is also a valuable tool for preserving government data, as evidenced during Donald Trump's presidency when various government website data, such as climate change information and LGBTQ+ resources, were altered or removed. This comprehensive overview equips attendees with a versatile toolkit for extracting valuable web data.", "description": "This talk presents a brief introduction to various techniques for scraping websites using the Python programming language. Web scraping refers to the automated process of extracting data from websites using software tools or scripts. Web scraping allows you to gather data from multiple sources on the internet and collect it in a structured format for analysis, research, and other purposes.\r\n\r\nThere are numerous legitimate uses for scraping websites, notably content aggregation, research and data analysis, job searching, social media analysis, and legal/compliance monitoring. Backing up government data can also be helpful. Before being indicted four times (so far), Donald Trump was the 45th president of the United States. During his administration, there were several instances where government data was removed from government websites or altered. Some examples of altered or removed data include climate change and environmental data, healthcare enrollment information, animal welfare records, and LGBTQ+ rights and resources.\r\n\r\nWe will provide a brief introduction to three different approaches to website scraping. The simplest involves sending requests and using a library like Beautiful Soup to parse the results. This doesn't always work, though, since some sites use client-side Javascript to interact with the server. There are a couple of ways to deal with this. Browsers can be automated with tools like Selenium, and the results can then be parsed with a Python library. However, the results may not be easy to parse, and the final approach presented will show how to intercept and emulate XHR requests. This can potentially yield more data than the page displays.", "recording_license": "", "do_not_record": false, "persons": [{"code": "NJSCRD", "name": "Wendy Edwards", "avatar": null, "biography": "Wendy is a software developer interested in the intersection of cybersecurity and data science. She\u2019s involved in the NASA Datanauts program and participated in the SANS Women\u2019s Academy, earning GIAC GSEC, GCIH, and GCIA certifications. She has masters degrees in computer science and library and information science from the University of Illinois.", "public_name": "Wendy Edwards", "guid": "142b0a8c-f3da-5485-a785-2900d83232c6", "url": "https://cfp.hackfest.ca/hf2023/speaker/NJSCRD/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/7FMB8N/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/7FMB8N/", "attachments": []}, {"guid": "8d4896c4-c198-5cca-bb91-f6525194924a", "code": "UHGLNE", "id": 214, "logo": "https://cfp.hackfest.ca/media/hf2023/images/UHGLNE/a_train_with_the_texture_of_a_pickle__cyberpunk_st_JV1ZIL20_rXY4Ldz.png", "date": "2023-10-14T10:30:00-04:00", "start": "10:30", "duration": "02:00", "room": "Workshops & Speed", "slug": "hf2023-214-stable-diffusion-workshop", "url": "https://cfp.hackfest.ca/hf2023/talk/UHGLNE/", "title": "Stable Diffusion Workshop", "subtitle": "", "track": "Ai Security", "type": "Workshop - 120 minutes", "language": "en", "abstract": "Let's get hands on and dive into the marvelous world of \"artificial intelligence\" and \"prompt engineering\"!\r\n\r\nThis session will cover two CTF challenges based on Stable Diffusion which is a model capable of generating photo-realistic images given any text input. This will show in a practical fashion some real impact of something otherwise artificial.\r\n\r\nThe challenges are going to be solved step by step alongside a dive into diffusion models and technical details on machine learning.\r\n\r\nWe will provide a dedicated online environment that requires low computing power on your end to do prompt hacking and try out Stable Diffusion.\r\n\r\nPrerequisites:\r\nThis workshop supports three levels of technical readiness:\r\n1) To participate in prompt hacking, bring any laptop or cellphone with a Web browser\r\n2) For a more low-level challenge, bring a laptop with Python installed\r\n3) To optionally play with Stable Diffusion tools locally, a laptop with dedicated 3D graphic card is required\r\n\r\nL'aide aux participants en Fran\u00e7ais sera aussi disponible.", "description": "This workshop uncovers some details about machine learning and models that leads the participants to form a proper yet simple technical understanding of how image related \"AI\" works.\r\n\r\nOutline:\r\n- Intro (15mins)\r\nWhat is Stable Diffusion\r\nWhat is a Model and Prompt Engineering\r\n\r\n- Workshop Part 1 (45mins)\r\nModel RCE\r\nDoable with a laptop and Python\r\nThis will be classic Python Pickling, requires some programming skills\r\nSolution given after 30mins\r\n\r\n- Break (15mins)\r\nWill also be used to catch up with some participants\r\n\r\n- Workshop Part 2 (45mins)\r\nDoable with cellphone or laptop Web browser\r\nThis will be finding what\u2019s hiding in the deep learning brain\r\nThis is bleeding edge prompt hacking and is surprisingly accessible by everyone\r\nSolution given after 30mins\r\n\r\n- Bonus: Hypernetworks\r\nIf time permits, we can look deeper at Hypernetworks and how they are being trained. This is related to the challenges above as the base of it, but also opens the topic to ethical and privacy concerns.", "recording_license": "", "do_not_record": true, "persons": [{"code": "MMM8EQ", "name": "Jonathan Marcil", "avatar": null, "biography": "Jonathan is part of NorthSec as a CTF challenge designer. He is passionate about Application Security and enjoys architecture analysis, code review, threat modeling and debunking security tools. Jonathan holds a bachelor's degree in Software Engineering from ETS Montreal and has 20 years of experience in Information Technology and Security.", "public_name": "Jonathan Marcil", "guid": "5d901a48-e3b2-5282-a6dc-501ea324bd89", "url": "https://cfp.hackfest.ca/hf2023/speaker/MMM8EQ/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/UHGLNE/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/UHGLNE/", "attachments": []}, {"guid": "b812c495-525c-57a6-ab75-bd8a806bb7d9", "code": "QC9U39", "id": 200, "logo": null, "date": "2023-10-14T13:30:00-04:00", "start": "13:30", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-200-a-primer-on-wipers", "url": "https://cfp.hackfest.ca/hf2023/talk/QC9U39/", "title": "A Primer on Wipers", "subtitle": "", "track": "Threat Intelligence / OSINT", "type": "Speed Talk", "language": "en", "abstract": "We'll be taking a look into the history and technical evolution of wiper malware, starting from Shamoon all the way to the modern-day wipers found in the Russia-Ukraine conflict.", "description": "There's several topics we'll cover:\r\n\r\nIn the first section, we'll talk about what wipers are and how they are defined in academic literature as well as security news reporting. We'll establish what the general motive of a wiper attack is, what threat actors tend to use wipers, and what the typical patterns are in terms of tactics and techniques.\r\n\r\nIn the second section, we'll discuss the chronological history of wipers and use it to frame how wiper malware has evolved over time. The central focus of this to highlight the commonalities and recurring themes through history even as the technical sophistication can grow.\r\n\r\nFinally, we'll discuss some of the various types of wiper malware identified in the modern-day, particularly the wiper attacks on Ukraine. \r\n\r\nThroughout the talk, we'll be citing several different sources from academic and industry research. My hope is that this talk can provide a helpful jumpstart for those who are interested to dive deeper, but the presentation itself should provide a helpful summary of what we know about wipers today.", "recording_license": "", "do_not_record": true, "persons": [{"code": "XTFZVA", "name": "Ali Maredia", "avatar": null, "biography": "Ali Maredia is a security engineer, working on enterprise security architecture and developing security tools. Prior to that, he worked as a security engineer in the financial industry, specializing in threat intelligence. With a background in software engineering, Ali holds a bachelor's degree from the University of Texas at Austin. His interests include CTFs and teaching programming to underprivileged youth.", "public_name": "Ali Maredia", "guid": "ee634add-e0c4-52bd-8812-f814555b11d8", "url": "https://cfp.hackfest.ca/hf2023/speaker/XTFZVA/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/QC9U39/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/QC9U39/", "attachments": []}, {"guid": "94ec9c05-f97d-5d4e-b4c2-d7f8857a1da8", "code": "Z9GXQD", "id": 227, "logo": null, "date": "2023-10-14T14:00:00-04:00", "start": "14:00", "duration": "00:20", "room": "Workshops & Speed", "slug": "hf2023-227-reduire-les-faux-positifs-et-utiliser-les-alertes-basees-sur-le-risque-risk-based-alerting-rba", "url": "https://cfp.hackfest.ca/hf2023/talk/Z9GXQD/", "title": "R\u00e9duire les faux positifs et utiliser les alertes bas\u00e9es sur le risque (Risk-based alerting/RBA)", "subtitle": "", "track": "Defensive", "type": "Speed Talk", "language": "fr", "abstract": "Le ph\u00e9nom\u00e8ne de la \"fatigue des alertes\" (\"alert/ticket fatigue\" en anglais) est bien r\u00e9el et affecte probablement la majorit\u00e9 des organisations poss\u00e9dant un SOC. Les diff\u00e9rentes solutions de s\u00e9curit\u00e9 g\u00e9n\u00e8rent de plus en plus d'alertes et afin d'\u00e9viter au maximum l'\u00e9puisement de nos \u00e9quipes qui peuvent traiter des faux positifs \u00e0 r\u00e9p\u00e9tition, il faut repenser \u00e0 notre strat\u00e9gie vis-\u00e0-vis celles-ci. Une piste int\u00e9ressante est la mise en place des alertes bas\u00e9es sur le risque, sommairement, les deux principaux avantages seraient de r\u00e9duire le nombre de faux positifs et d'\u00e9galement d\u00e9tecter des \u00e9v\u00e9nements qui individuellement n'auraient potentiellement pas lev\u00e9 d'alertes.", "description": "- Introduction (~1min)\r\n- Qu'est-ce que la fatigue des alertes et pourquoi il faut en tenir compte? (~2min)\r\n- Comment g\u00e9rer la balance entre le volume d'alertes \u00e0 traiter et la r\u00e9duction des faux positifs? (Est-ce dangereux de r\u00e9duire nos seuils pour recevoir moins d'alertes? Risque-t-on de manquer des alertes importantes?) (~4min)\r\n- Pourquoi est-il possible pour une organisation de ne pas d\u00e9tecter certaines activit\u00e9s suspectes malgr\u00e9 la pr\u00e9sence de centaines de cas d'usage (Use Case)? (~4min)\r\n- Alerte vs. \u00e9v\u00e9nement notable (~3min)\r\n- Attribuer des scores de risque \u00e0 des objets via les \u00e9v\u00e9nements notables et g\u00e9n\u00e9rer des alertes selon un seuil pr\u00e9d\u00e9fini (Les scores peuvent se multiplier selon les phases de l'attaque (MITRE/Cyber Kill Chain) ou la s\u00e9v\u00e9rit\u00e9 des \u00e9v\u00e9nements, notre imagination est la limite.) (~4min)\r\n- Conclusion et questions (~2min)", "recording_license": "", "do_not_record": false, "persons": [{"code": "J8B7SF", "name": "Jean-Francois Brouillette", "avatar": null, "biography": "La carri\u00e8re de Jean-Fran\u00e7ois a d\u00e9but\u00e9 dans la gestion de syst\u00e8mes informatiques il y a un peu plus d\u2019une dizaine d\u2019ann\u00e9es avant de se sp\u00e9cialiser en cybers\u00e9curit\u00e9. Il a pass\u00e9 quelques ann\u00e9es \u00e0 agir \u00e0 titre de consultant (KPMG Egyde) et \u00e0 r\u00e9pondre \u00e0 des situations de crises \u00e0 travers le monde dans des organisations d\u2019envergures lors de cyberattaques. Jean-Fran\u00e7ois s\u2019est ensuite joint \u00e0 l\u2019\u00e9quipe de la Banque Nationale du Canada afin d\u2019appuyer leur \u00e9quipe de cyberd\u00e9fense et aider \u00e0 faire progresser la pratique de r\u00e9ponse aux cyberincidents. Sa motivation a toujours \u00e9t\u00e9 de contribuer, en utilisant ses comp\u00e9tences, \u00e0 pr\u00e9venir les cyberattaques et de compliquer, le plus possible, la vie des cybercriminels.", "public_name": "Jean-Francois Brouillette", "guid": "6834cefb-98ac-5f54-832f-0e42162f587e", "url": "https://cfp.hackfest.ca/hf2023/speaker/J8B7SF/"}], "links": [], "feedback_url": "https://cfp.hackfest.ca/hf2023/talk/Z9GXQD/feedback/", "origin_url": "https://cfp.hackfest.ca/hf2023/talk/Z9GXQD/", "attachments": []}]}}]}}}