2.0 -//Pentabarf//Schedule//EN PUBLISH Q9MVYT@@cfp.hackfest.ca -Q9MVYT Weaponizing and auditing secret servers for further compromise en en 20231013T090000 20231013T095000 005000

Weaponizing and auditing secret servers for further compromise

The target audience of this presentation is security professionals, application developers and application owners. The presentation will start by explaining the concept of a secret server, or vault, and highlight why they are part of the current application security best practices. They empower administrators in the management of application credentials, they offer better storage options than the traditional methods such as on-disk storage and help greatly in maintaining an accurate inventory of accounts. Applications are given initial credentials, which may be Windows domain credentials, to connect to the secret server and gather all the other secrets they require for their normal operations. These new secrets can be usernames, passwords, RSA keys, certificates, files, etc. As an attacker, when you compromise an application that can access a secret server and leak its credentials, the next logical step is to remotely access the secrets contained in the secret server. Doing so, you may gain access to hundreds of secrets. The obtained new secrets may also be able to connect to the secret server, and leak even more secrets, and so on and so forth. Some of them you may already have, some of them may be new. It results in a lot of data that requires processing, and a lot of attack surface to explore. It quickly gets tedious to audit and perform a thorough assessment. The recursive process of abusing secret server secrets in a tree-like fashion to gather an exponential number of secrets is a new concept that requires proper tooling and needs to be exploited in offensive security engagements. Currently, there are no tools available to remotely interact with the secret server APIs and extract secrets recursively. Current tools dump and decrypt the databases when accessed on the local file system, but it is not a scenario that happens often as it requires compromising the secret server's machine itself. To tackle the problem, I developed a tool called SSCrawl. It is a multi-threaded recursive secret gatherer for secret servers. It supports multiple secret server vendors and is extendable to support even more. It will gather secrets for an account and use the found secrets to attempt to connect to the secret server recursively. An overview of the tool's implementation and features will be presented, along with a demo. SSCrawl also generates graphs of the compromised secrets for better visualization and to facilitate presenting the results to stakeholders. Graph demos will be shown to visualize the exploitation paths. SSCrawl will be released after the presentation. The presentation will end with recommendations on how to prevent the issue by hardening accounts and monitoring secret server accesses. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/Q9MVYT/ Track #1 Simon Lacasse PUBLISH DTF3C8@@cfp.hackfest.ca -DTF3C8 Agir AVANT fr fr 20231013T100000 20231013T105000 005000

Agir AVANT

À la base, la cybersécurité repose sur une bonne hygiène TI : s'occuper de ses systèmes, de mettre en place des bons outils mais aussi des bonnes pratiques, faire en sorte que la cybersécurité fasse partie de la discussion corporative de tous les jours. Trop d'entreprises attendent qu'il soit trop tard - elles décident de se préoccuper des ces enjeux seulement APRÈS qu'il ait eu un évènement important. Dans cette présentation, nous allons examiner comment et pourquoi les PME sont si vulnérables, et comment un entrepreneur a décidé de prendre en main sa sécurité et de prioriser les efforts. Ensemble, nous avons implanter les contrôles de CyberSécuritaire Canada (non, on ne va pas passer à travers tous les contrôles - il y a déjà eu des présentations à ce sujet !) ; nous allons voir le "pratico-pratique" de protéger son entreprise. Et bien sûr, pourquoi il est important d'agir AVANT ! PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/DTF3C8/ Track #1 Jacques Sauve PUBLISH RUNDRV@@cfp.hackfest.ca -RUNDRV Dans le monde de Git - De Zéro à Héros fr fr 20231013T110000 20231013T115000 005000

Dans le monde de Git - De Zéro à Héros

La présentation se divise en **2** portions, la première est sur **Git** et la deuxième est sur le développement de type DevOps en utilisant les **pipelines CI/CD**. La présentation va se terminer sur les avenues de solution afin d'améliorer son Git-fu. * Qu'est-ce que GIT? * Level 1 - Commandes Git * Level 2 - Les petites subtilités * Level 3 - Conflicts, Branches, Merge Request, Stash, etc. * Pipelines - CI/CD * Avenues de solutions ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/RUNDRV/ Track #1 Félix Lehoux PUBLISH Q9WGGG@@cfp.hackfest.ca -Q9WGGG Android Application and APIs hacking en en 20231013T133000 20231013T142000 005000

Android Application and APIs hacking

Outline Who am I? From blogger to pentester What is Android What is an Android App Pentest? Why Android App Pentest? (example for KellyTech malware) Some figures (Impactful key figures in the Android vulnerabilities and attacks) What about Android APIs? Android App pentest process (Presentation of the different phases for this type of pentest) The importance of the lab (Why this lab is different from labs of other pentests) Which tools will you need (Presentation of Jadx, ADB, Android Studio and Burpsuite) How to set up the lab Installations Create an emulator (video demo) Configure Burp (video demo) Deep dive in the process Presentation of the vulnerable Apps used for the examples Static Analysis How to check the code Example Android Manifest, permissions Example Android Manifest, allow backup and debuggable Find the API endpoints How are APIs called - Example Fetch API Javascript - Example API vulnerabilities Example - Strings.xml (hardcoded API key) Grep it (how to use grep to search for secrets General tips for static Analysis Tools for static analysis (firebase enum, firebaseScanner, Cloud Enum) Dynamic Analysis Find API endpoints Example - Background Capture (video demo) Common API vulnerabilities to look for Use checklists Automatic tools (Mobsf Qark) What about Mobile API vulnerabilities (A focus on specific API vulnerabilities and attack) How to report Methodology Example of reporting (for the vulnerability BG capture) Resources Practice Courses and Misc References and Reads Tools Go Further with certificate pinning Quiz to go (a link to a an online quiz will be given) PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/Q9WGGG/ Track #1 Gabrielle Botbol PUBLISH BWKUFD@@cfp.hackfest.ca -BWKUFD Exploring RAM Forensic Analysis for Effective Digital Investigations en en 20231013T143000 20231013T152000 005000

Exploring RAM Forensic Analysis for Effective Digital Investigations

As a Threat Hunter, RAM forensic analysis is crucial in carrying out digital investigations for Rapid Incident Response as I often need to respond swiftly to emerging threats and security incidents and RAM forensic analysis enables quick access to volatile memory, providing valuable insights into the state of the system at the time of the incident. This allows Threat Hunters to identify active processes, network connections, malicious artifacts, and other critical indicators of compromise, facilitating faster incident response Sophisticated attackers employ advanced techniques to evade detection, such as fileless malware and memory-resident threats. RAM forensic analysis enables me as a Threat Hunter to identify and analyze these stealthy attacks by examining memory artifacts and uncovering hidden indicators of compromise. This empowers Threat Hunters to detect and mitigate advanced threats that may bypass traditional security measures.RAM contains a wealth of digital artifacts, including running processes, network connections, and cryptographic keys. These artifacts can provide crucial insights into the activities and intentions of threat actors. I leverage RAM forensic analysis techniques to extract and analyze these artifacts, enabling deeper investigation and threat intelligence gathering.Some threats specifically target and reside in memory to carry out malicious activities. By focusing on memory analysis, I proactively hunt for memory-based threats, such as in-memory malware, code injection, or process hollowing techniques. This approach allows for the detection and remediation of threats that may go undetected by traditional signature-based security solutions. After an incident, I often engage in post-incident analysis and attribution to understand the root cause, scope, and impact of the attack. RAM forensic analysis provides valuable forensic evidence that can aid in this process. Memory artifacts can reveal attacker behaviors, persistence mechanisms, and even clues regarding their identity or affiliation. This information enhances the ability to attribute attacks to specific threat actors or groups. Through this presentation, I want to emphasize on how Memory forensics is a powerful technique to augment every cybersecurity professional with threat detection and response capabilities. By leveraging memory analysis, one can gain deeper insights into active threats, enhance incident response speed, and proactively hunt for memory-based attacks, ultimately strengthening their organization's overall cybersecurity posture. The target audience for this talk on RAM forensic analysis can include Digital Forensic Analysts, Threat Hunters, Incident Responders, Cybersecurity Professionals, Law Enforcement Personnel and Security Researchers. Flow of the Talk: Introduction (5 minutes): ● Overview of the significance of RAM forensic analysis in digital investigations ● Explanation of the objectives and structure of the talk Understanding Volatile Memory (5 minutes): ● Definition and explanation of volatile memory ● Discussion of the types of information stored in volatile memory Memory Acquisition Techniques (10 minutes) ● Live memory acquisition: Explanation of the process and its advantages ● Memory imaging: Overview of creating forensic images of volatile memory Introduction to Memory Analysis Tools (5 minutes) ● Overview of popular memory analysis tools such as Volatility ● Explanation of the functionalities and capabilities of these tools Analyzing Memory Artifacts (10 minutes) ● Examination of key artifacts found in volatile memory ● Demonstration of analyzing running processes, network connections, and open files ● Showcase of extracting cryptographic keys and sensitive data from memory Challenges and Mitigation Strategies (5 minutes) ● Overview of challenges faced in RAM forensic analysis Conclusion and Takeaways (5 minutes) ● Recap of key points discussed throughout the talk ● Emphasis on the value of RAM forensic analysis in digital investigations ● Encouragement for attendees to apply these techniques in their own work Q&A Session (5 minutes) Opportunity for the audience to ask questions and seek clarification on any topic covered in the talk Key Takeaways: - Memory Analysis Tools: Explore popular memory analysis tools like Volatility, and understand their functionalities and capabilities for efficient analysis of volatile memory. - Analyzing Memory Artifacts: Discover the types of valuable artifacts stored in volatile memory, including running processes, network connections, open files, cryptographic keys, and sensitive data, and learn techniques for extracting and analyzing these artifacts. - Detection of Memory-based Threats: Understand the concept of memory-based threats, such as in-memory malware and code injection, and learn proactive hunting techniques to detect and mitigate these stealthy threats. - Overcoming Challenges: Identify the challenges faced in RAM forensic analysis, including anti-forensic techniques and encryption, and gain insights into effective mitigation strategies and best practices. - Practical Application: Recognize the practical application of RAM forensic analysis in digital investigations, and be inspired to leverage these techniques to enhance incident response, threat hunting, and forensic analysis in your own work. By the end of the talk, attendees will have a comprehensive understanding of RAM forensic analysis, its technical aspects, its value in digital investigations, and the practical knowledge to effectively utilize this technique in their own work. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/BWKUFD/ Track #1 Sneha Banerjee PUBLISH F7FZUR@@cfp.hackfest.ca -F7FZUR Automatiser la Cyberdéfense: feuille de route et trucs pour bien s'en SOARtir fr fr 20231013T153000 20231013T162000 005000

Automatiser la Cyberdéfense: feuille de route et trucs pour bien s'en SOARtir

Durant le talk, on va introduire le concept de SOAR, clarifier ce que ça fait et pourquoi on le fait. Le plus possible, ça sera présenté avec des exemples concrets et/ou des cas vécus. - Introduction & Agenda (2 minutes) - Pourquoi automatiser? (4 minutes) - C'est quoi un SOAR, exemples de SOARs et les différents types de SOAR (7 minutes) - Types d'automatisations et exemples (20 minutes) - Contextualisation - Priorisation - Automatisation de la réponse - Qui devrait développer dans un SOAR? (7 minutes) - Automatiser ne remplace pas des bons processus (4 minutes) - Étude de cas d'un grand SOC après trois ans (5 minutes) PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/F7FZUR/ Track #1 Émilio Gonzalez PUBLISH KUUB8L@@cfp.hackfest.ca -KUUB8L War from home: la technologie au service de la mobilisation ukrainienne fr fr 20231013T163000 20231013T172000 005000

War from home: la technologie au service de la mobilisation ukrainienne

La présentation mettra en lumière les aspects uniques de la manière dont les Ukrainiens mobilisent la technologie pour amener le combat dans le cyberespace et dans l’infosphère (guerre hybride). Chacune des sections comportera au moins une étude de cas, et des images originales pour appuyer la présentation. Réseaux Sociaux (10 minutes): Exploration de l'utilisation des réseaux sociaux pour la diffusion d'informations, la coordination des efforts, et la lutte contre la désinformation. Étude de cas : NAFO, Saint-Javelin Drone (10 minutes): Modification hardware/software: présentation des innovations technologiques dans la modification de drones civils pour des opérations de reconnaissance et de guerre psychologique. Étude de cas : Follow Me IT Mobilisation (10 minutes): Discussion sur la formation et le rôle de l'IT Army dans la cyberguerre. Exploration de leurs stratégies et de leurs succès dans la défense contre les cyberattaques. Étude de cas: Engineers for Ukraine, IT army of Ukraine (objectifs des organisations, méthodes d’opérations, fonctions). OSINT (10 minutes): Analyse de l'utilisation de l'OSINT. Comment l'intelligence open source a façonné la guerre et contribué à informer le publique et l’aider à rester en sécurité. Étude de cas : Monitor War, Twitter spaces, Deepstatemap Questions et Réponses (10 minutes): session interactive où les participants peuvent poser des questions et discuter des sujets abordés. La présentation mettra en évidence la manière dont la technologie est utilisée de manière innovante et efficace dans le contexte du conflit ukrainien. Elle soulignera également l'importance de la collaboration internationale et de l'éthique dans la conduite de la guerre dans le cyberespace. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/KUUB8L/ Track #1 Gabrielle Joni Verreault Luc Lefebvre PUBLISH SWWCDY@@cfp.hackfest.ca -SWWCDY Rubber DuckHunt - Détection d'un classique fr fr 20231013T173000 20231013T175000 002000

Rubber DuckHunt - Détection d'un classique

Lors de cette présentation, nous explorerons divers outils et techniques de Keystroke Injection, incluant le Rubber Ducky et ses nouvelles fonctionnalités, le Key Crocs associé à Cloud C2, le MouseJacking, et d'autres outils pertinents. Nous discuterons de la manière dont les systèmes actuels détectent ces attaques. Je dévoilerai également un outil innovant que j'ai développé, nommé "Rubber Duck Hunt", conçu pour détecter le comportement des attaques de Keystroke Injection. Cet outil utilise plusieurs méthodes d'analyse comportementale, telles que le pattern de frappe (vitesse, combinaisons de touches, mots-clés, etc.), la détection de nouveaux claviers connectés. De plus, un journaux windows est généré, ce qui permet l'aggrégation dans un SIEM ce qui permet une détection dans une grande entreprise. L'outil sera rendu disponible au public à la suite de cette présentation. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/SWWCDY/ Track #1 Eric M. Gagnon PUBLISH CXGCQZ@@cfp.hackfest.ca -CXGCQZ Podcast La French Connection - Épisode LIVE (salle 201A) fr fr 20231013T205500 20231013T225500 020000

Podcast La French Connection - Épisode LIVE (salle 201A)

La French Connection (https://securite.fm) Rejoignez-nous ici en direct le samedi 14 octobre à 21h00 EST Sujets couverts: - Retour sur le Hakfest 2023 - Retour sur l'année 2023 - Give me ransomware, loads of ransomware - Cybersécurité du gouvernement du Québec - Nouvelles infosec - Recrutement en sécurité informatique - La Friends Connection - Questions du public - Poutine - Poolcast stories - Le dude du Hackfest - Défions le statu quo - D'la pizza aux ananas - Over 'n' out - Et plus encore!!! PUBLIC CONFIRMED Workshop - 120 minutes https://cfp.hackfest.ca/hf2023/talk/CXGCQZ/ Track #1 L'équipe de La French Connection PUBLISH F783UL@@cfp.hackfest.ca -F783UL Une surveillance RDP sans précédent révèle le savoir-faire des attaquants fr fr 20231013T090000 20231013T095000 005000

Une surveillance RDP sans précédent révèle le savoir-faire des attaquants

Lors de l’écriture de cette présentation, nous n’Avons pas pu nous empêcher de faire des parallèles avec l'univers de Donjon et Dragon qui a été popularisé récemment par Stranger Things et le film Honor Among Thieves. Nous avons pensé que ce récit soutiendrait bien notre histoire. 1) Le protocole RDP (Remote Desktop Protocol) comme vecteur d'attaque critique dans les groupes de rançongiciel. 2) Exploiter la profondeur des captures RDP 3) Présentation de notre outil d'interception. open source appelé PyRDP et de ses capacités. Capacités d'écran, de clavier, de souris, de presse-papiers et de collecte de fichiers Présentation de notre honeynet et de notre architecture système 4) Méthode de collecte de données (plus de 150 millions d'événements, dont 20 millions de hachages NetNTLMv2 capturés, 3 200 sessions de connexion réussies analysées, 570 fichiers transférés, 21 705 captures RDP collectées et plus de 100 heures de vidéos. 5) Caractériser les attaquants Présentation des différents types d'attaquants, de leurs caractéristiques et séquence vidéo de leurs actions. -Les bardes, sans compétences apparentes en matière de piratage informatique, effectuent des recherches obtuses ou regardent des vidéos pour adultes. Ils ont potentiellement acheté l'accès RDP à quelqu'un qui a compromis le système pour eux, alias Initial Access Brokers (IAB). -Les rodeurs explorent furtivement les ordinateurs et effectuent de la reconnaissance, ouvrant ainsi la voie à d'autres types d’attaquants. -Les voleurs tentent de monétiser l'accès RDP par diverses méthodes créatives, telles que des monétiseurs de trafic ou des cryptomineurs. -Les barbares utilisent une large gamme d'outils pour attaquer davantage d'ordinateurs. -Les magiciens, sécurisant leur identité via d’autres hôtes compromis, utilisent leur accès RDP comme portail magique pour dissimuler leurs origines. 6) Armement des attaquants Nous couvrirons les outils utilisés par les différents attaquants comme MassScan GUI, NLBrute, SilverBullet, XMRig (cryptominer), Traffmonetizer, DControl et plus encore. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/F783UL/ Track #2 Andreanne Bergeron PUBLISH HAK8SR@@cfp.hackfest.ca -HAK8SR Jedi Contre les hackers fr fr 20231013T100000 20231013T105000 005000

Jedi Contre les hackers

- L'histoire de Groupe ISM et son Cybercrime majeure en 2017 - Comment rechercher sur sur le Darkweb et le naviguer de façon sécuritaire - Découvrir le comportement des hackers actifs au Québec en ce moment à travers des Cybercrime d'ici - Parcourir les exfiltration de données des entreprises québécoise ou canadienne disponible - Validation de la sécurité et l'intégrité suite à un Cybercrime majeure ou une exfiltration des données BIO : En tant que PDG du Groupe ISM situé au Canada. Le groupe ISM et Simon David Williams ont survécu à un cybercrime majeur et ont aujourd'hui contribué à 37 cybercrimes majeurs. L'objectif est d'aider l'industrie des TI à protéger et conscientiser les personnes de leur réseaux, avant, après et pendant une attaque active de Ransomware. Dans cette conférence, vous naviguerez sur le Darkweb et verrez comment sécuriser votre organisation et vous-même en apprenant comment les pirates publient et agissent dans un cybercrime et de quelle façon les Script-Kiddie les utilisent PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/HAK8SR/ Track #2 Simon David Williams Audrey Shink PUBLISH AEQMVB@@cfp.hackfest.ca -AEQMVB You Won’t Own Passwords, and You’ll Like It en en 20231013T110000 20231013T115000 005000

You Won’t Own Passwords, and You’ll Like It

1) Intro: Why Passwords Suck The motivation for this talk is to introduce passkeys to the audience and explore the available attack surface for a penetration tester. A quick review of the reasons passwords are difficult for users to handle and manage securely. This argument will be supported by statistics about the number of breaches caused by compromised password credentials. Passkeys are the future of passwordless authentication because they have been adopted by Google, Microsoft and Apple, and are built into all modern consumer platforms. Passkeys will address the major security concerns of passwords with the following properties: - Asymmetric secret sharing for breach containment. - Phishing resistance - Simple user experience with biometrics user verification, cross device authentication flows and recoverability. 2) What are Passkeys How passkeys build on the WebAuthN standard leveraging UAF. Definitions of the components, their dependencies and interactions: - Universal Authentication Framework (UAF) - Universal Second Factor (U2F) - Web Authentication (WebAuthN) - Client to Authenticator Protocol (CTAP/CTAP2) - Passkeys How Google, Apple and Microsoft implement passkey portability and recovery based on public security architecture documents. 3) Passkey’s Attack Surface The passkey API implements two actions “Create” and “Authenticate”. I’ll review the fields in each of these API calls and discuss its role in the protocol and how a penetration tester may be able to attack it. 4) Penetration Testing Passkeys with BurpSuite Plugin I have developed a new BurpSuite Plugin that identifies WebAuthN/Passkeys in web traffic and scans them for vulnerabilities. I will discuss several of the vulnerabilities including: - Weak public key algorithms - Sufficient entropy and randomness for challenges - Authentication weakness for public keys - Weak account authentication enumeration - Domain/Sub-domain scoping After covering the attack surface for passkeys, I’ll look at the most viable attack paths for a penetration test to achieve account takeover. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/AEQMVB/ Track #2 Alex Cowperthwaite PUBLISH WN3KKJ@@cfp.hackfest.ca -WN3KKJ Avons-nous amélioré notre résilience à l’évolution technologique en 25 ans ? fr fr 20231013T133000 20231013T142000 005000

Avons-nous amélioré notre résilience à l’évolution technologique en 25 ans ?

Cette présentation se veut une réflexion commune afin de changer nos perceptions en vue d’une meilleure préparation à ces risques. En 1998, le nord-est de l’Amérique du Nord a subi un évènement météorologique hors du commun soit une tempête de verglas, avec de grandes conséquences sur l’économie de 3 provinces et 3 états américains. Il y a eu heureusement peu de décès (la majorité attribuable à la mauvaise utilisation de chauffage d’appoint) et notre société débutait à peine à découvrir l’Internet. Pendant près d’un mois, beaucoup ont eu à apprendre à composer avec des difficultés d’organisation logistique (nourriture, carburant, médicaments) et comment se tenir au chaud si la vie de refuge d’urgence n’était pas possible. 25 ans plus tard, nous avons reçu cet hivers un autre épisode de verglas qui a simplement créer des problèmes avec des coupures électriques de quelques jours due aux arbres mal entretenus. Devant ce constat, si l’épisode de verglas 2023 aurait été aussi grave qu’en 1998, considérant la dépendance de notre société au numérique et comment l’économie est basée sur du « just in time », est-ce que notre société, notre économie et nos gouvernances à tous les niveaux, prêt à y faire face de manière à réduire les conséquences à un niveau acceptable ? Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // Remplissage 500 mots // PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/WN3KKJ/ Track #2 Steve Waterhouse PUBLISH Q99AGU@@cfp.hackfest.ca -Q99AGU VPNs are Internet snake oil en en 20231013T143000 20231013T152000 005000

VPNs are Internet snake oil

Brief outline - History lesson on “snake oil” & Virtual Private Networks (VPNs). Why people may want to hide their identity online - What a commercial Virtual Private Network (VPN) service can and cannot do for you. - The surveillance problem in your pocket. - Beyond VPNs: Recommendations to help limit online tracking and surveillance, for various levels of paranoia This talk is a rapid-fire and comprehensive takedown of the entire concept that use of commercial VPN services create any real privacy or security benefits for most users. It will give a summary of what things a VPN service can and cannot do to hide your online activities and footprint. It will provide an overview of the many methods used by advertisers and social media companies for tracking and monitoring end-uses that go far beyond browser cookies. It will also offer suggestions on mitigations against these methods, and a short discussion of how to truly be anonymous or untraceable online -- a harder problem than you think. Below is a collection of information fragments to be organized into the final presentation format. The reality is that VPNs actually do almost nothing to improve your security online. Using a VPN can hide your IP address and make it appear that you are connecting from another location, but by itself a VPN doesn't hide your identity or your online activities, browsing patterns, or websites site visit. Yes, VPNs can provide some limited value when dealing with public Wi-Fi networks that do not use any encryption. This defends against the "coffee shop" sort of attacks with a compromise of the NAT router or a man-in-the-middle attack, or against passive surveillance of your traffic. Most endpoint Internet traffic is encrypted with TLS these days, making it hard to intercept. A commercial VPN services primary use case is to present a different geographic location to the various content providers and governments that try to control access based on geoip lookup. However, most VPN services utilize IPv4 blocks in data centers that are easily blocked by the content providers. VPN services buy and deploy new IPv4 subnets, but it is "whack a mole". Legitimate ISPs are also caught up in the geo blocking game, and are often banned by content providers erroneously. Some VPN services have very murky ownership. There are free VPN services (who is the product here?). Foriegn purchase and ownership of VPn services and motivations is an entire rabbit hole. Web and advertising tracking -- hard to escape. Tracking cookies are everywhere and if you are not using a clean browser without cookies, you will be tracked. DNS traffic can still be monitored by the VPN service unless DoH/DoT is in use. Browser fingerprinting methods - can get your down to a unique down to 1 out of 250k+ browsers. Things you don’t think about that can get you, what fonts you have installed can be used to help provide that unique fingerprint Ok, ok, so I use a VPN and a clean browser in a Virtual machine, I’m good right? I can do the shady thing safely, right? No. Your traffic is still visible from the source point of the VPN provider, and even the ones that say they don’t do logging are doing logging (or the local government is) plus the wire tapping going. Yes, much of your session traffic will be HTTPS encrypted, but that leaks data with SNI and certificate checks. DNS queries can leak. wiretapping... known legal and otherwise. Room 641A and others all over the place. NSL and other government powers to compel cooperation. https://en.m.wikipedia.org/wiki/Room_641A The USA is far from the only government doing this sort of broad traffic collection. Some are also doing censorship/filtering at the national level (deep packet inspection and also DNS based). In some places, ISPs are required to install "middle boxes" that not only try to censor information, but are also used for survelliance. netflow data aggregation currently in the hands of corporations and governments. What is netflow? Records to sample activities based on 5 Tuple src/dst ip and and port, plus interface source, protocol type. There are broadband equipment vendors that use netflow data to report on subscriber online activity, and have interesting privacy policies. Some are selling these data streams to traffic intelligence services. Think of it as Nielsen ratings for online activities. There are ISPs that use netflow cloud services (Kentik) . Which make convenient Central places to send NSLs if you want some data.. Listen carefully to statements or legal policies. Hairs are split. “We don’t listen to all your phone calls” — no, but you can record them and listen to them later. special browsers for privacy. Browser plugins for ad blocking and tracking. Discuss all the options in detail. VPN technical requirements (ciphers and strength) that are desirable and NIST guidlines. . Some recommendations for actual security, which is much harder, but recommended if you are wanting to do shady things online or your threat model includes nation state actor risks. Journalist discussion. 1. Use a dedicated local hardware device (NAT routers) for your VPN to your own cloud VPS (small home router or rasp PI). Change your external faciny MAC address, and you can double-NAT this through your normal firewall. 2. Use TAILs on an old laptop, connected to your VPN device with zero state, via ethernet wire. Could be an entire discussion. 3. Make your last mile as untraceable to you as possible — long distance wireless, business/school etc without cameras and logging. Not easy to do. 4. Many ISPs keep DHCP logs with MACs.. Sometimes for years. CGNAT translation, records of all session traffic. . They can tie your physical location and account to your Ethernet MAC of your router. For subpoenas. 5. Disable laptop camera and microphone in hardware. 6. Don’t do shady things from your home or work or anyplace else that can be traced to you. 7. Best way to do shady things is use other people’s computers remotely over covert channels, from additional other untraceable locations (I'm behind seven proxies!) Some resources that will be used: https://coveryourtracks.eff.org https://freedom.press/training/choosing-a-vpn/ https://ssd.eff.org https://www.privacyguides.org https://pixelprivacy.com/resources/browser-fingerprinting/ PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/Q99AGU/ Track #2 James Troutman PUBLISH U8AXSF@@cfp.hackfest.ca -U8AXSF Combattre la violence technologique fr fr 20231013T153000 20231013T162000 005000

Combattre la violence technologique

<p><b>Épiées, suivies, tourmentées : 70% des victimes de violence conjugales rapportent de la violence technologique. Alors que l'environnement techno autour des victimes se complexifient, comment peut-on travailler à augmenter la littératie numérique auprès des populations vulnérables et mettre en place des outils de soutien. </b></p> <p><b>Introduction au phénomène et ampleur</b></p> Comment peut-on reconnaître la violence technologique, quels sont les impacts sur la victime et les proches de celle-ci et qu'est-ce qui explique que ce soit désormais une réalité omniprésente pour les victimes de violence conjugale. <p><b>Études de cas réels (anonymisés) et potentiels</b></p> Comment reconnaître la violence technologique et présentation de situations bien réelles - attention, contenu sensible. <p><b>Bonnes pratique d'intervention</b></p> Comment reconnaître les besoins de la victime : intervenir dans un contexte parfois dangereux - comment se protéger soi, savoir quand escalader aux forces de l'ordre et moduler l'intervention en fonction des connaissances techniques de la victime. <p><b>Couverture des aspects légaux / Comment préparer un dossier de preuves</b></p> Qu'elles sont les limites de l'aide qui peut être offerte? Comment monter un dossier de preuves afin de permettre à la victime d'accéder à des ressources supplémentaires, d'être prise au sérieux et de porter plainte. <p><b>Exploration des outils et ressources disponibles et à développer par la communauté</b></p> Quelles sont les outils et ressources déjà existants dans l'écosystème et que devrions nous développer en tant qu'experts dans la communauté pour soutenir les refuges, centre d'interventions et les victimes. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/U8AXSF/ Track #2 Catherine Dupont-Gagnon PUBLISH ZGFADY@@cfp.hackfest.ca -ZGFADY Unconditionally Conditional - Strong Authentication in Azure AD en en 20231013T163000 20231013T172000 005000

Unconditionally Conditional - Strong Authentication in Azure AD

This could be considered for Defensive or Security 101. - Introduction / Agenda / whomi 2 mins - Overview - why conditional access is important, how relates to zero trust - 3 mins - Microsoft Intune - start with devices - discuss various aspects of different method of joining devices and assessing device compliance using MS Intune - 15 mins - Device join types - Requirements for Hybrid Azure joined and Co-Managed - MDM vs MAM - differences, similarities and how they relate to one another in a layered approach. - MDM policies - details regarding options, successes, and pitfalls when applying device compliance policies. - MAM policies - details regarding options, successes, and pitfalls when applying application/container compliance policies. - Limitations - notable additional limitations within Intune, especially as it relates to method of onboarding devices, where compliance fits in relation to configuration profiles. - What else does Intune do? - reporting, patch management Conditional Access policies - there are a number of complications to how conditional access policies apply. Inclusion vs exclusion of items, objects, etc. Detailed discussion of the various filters and controls, how each is applied and managed - 15 mins - Users - Applications & Actions - Conditions - Sessions - Controls - Device filters - Limitations & Challenges - limitations discovered during large scale implementation - Putting it all together - 10 mins - Wide policies vs specific policies - affects of widely applied vs specific policies. - OS specific policies - Browser only vs App policies - settings that don't work on one or the other. - Interesting special cases - things that should never happen, but seem to all the time. Things you will want to block, control, or manage. - A blueprint from least to most trust across a grid of situations - 5 mins - Includes BYOD, On premise, off premise, fully managed, completely unmanaged and untrusted. - How this relates to healthcare settings - References Questions - 5 mins PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/ZGFADY/ Track #2 Don Mallory PUBLISH CGJ3ES@@cfp.hackfest.ca -CGJ3ES MITM on PSTN -- novel methods for intercepting phone calls en en 20231013T173000 20231013T175000 002000

MITM on PSTN -- novel methods for intercepting phone calls

Two separate methods will be proposed. The author will provide a pre-recorded demo of each attack. 1. PSTN / MN / CLIP / CNAM 2. SS7 features and attacks 3. Relevant social engineering techniques 4. Attack 1: Simultaneous ring attack 5. Attack 2: Diversion attack 6. Tactic 1: Interception of phone calls 7. Tactic 2: Alteration of phone calls (content) 8. Tactic 2: Alteration of phone calls (metadata) 9. Proposed solutions Note that the presentation includes pre-recorded demos as it's ill-advised to do this live in a conference for legal reasons. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/CGJ3ES/ Track #2 Kirils Solovjovs PUBLISH ADCHRP@@cfp.hackfest.ca -ADCHRP The Dark side of Cloud attack tools (underground style) en en 20231013T090000 20231013T095000 005000

The Dark side of Cloud attack tools (underground style)

I'll show you an analysis of 3 cloud hacking tools that were taken from the underground. These tools are being used these days by hackers and being sold/downloadable on the Darknet and other hackers forums. You will be amazed how simple to use these tools are and how easy it is to operate them. These tools are the first phase of hacking cloud accounts and emails. We will focus on brute force and password spraying tools, show you the tools, what they are doing and a deep analysis of the tools including decryption of their encrypted communication. To wrap it up we will talk about the current landscape changes of cloud attacks. 5 Minutes - Opening 5 Minute - Where did I got the tools 10 Minutes - 1st hacking tool analysis and explanation 10 Minutes - 2st hacking tool analysis and explanation 10 Minutes - 3st hacking tool analysis and explanation 5 Minutes - The current attack landscape of the cloud 5 Minutes Q&A PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/ADCHRP/ Workshops & Speed Yaniv Miron PUBLISH KQGZLF@@cfp.hackfest.ca -KQGZLF The Art & Science of Threat Hunting Endpoint Signal en en 20231013T110000 20231013T115000 005000

The Art & Science of Threat Hunting Endpoint Signal

The 2022 cyber threat landscape was defined by persistence, increased target scope and relentless determination. As businesses began to ease pandemic-driven operating environments and adjust to geopolitical shifts and growing economic hardships, adversaries supporting nation-state, eCrime and hacktivist motivations started 2022 with a relentless show of effort that endured throughout the year. Nation-state adversaries engaged in relentless computer network operations throughout 2022, emphasizing the integral role these operations play in supporting state goals. Russian state-nexus adversaries combined destructive, espionage and information operations (IO) attacks in constant support of the Ukraine war, and China statenexus adversaries dominated the cyber threat landscape with a significant increase in espionage operation volume and target scope. Iran continued to focus on regional espionage campaigns and their now-signature destructive “lock-and-leak” operations leveraging ransomware, and Democratic People’s Republic of Korea (DPRK) state-nexus adversaries persisted in cryptocurrency theft campaigns to supplement state funds in the wake of the COVID-19 pandemic and the nation’s long-standing economic hardship. Over the course of 2022, eCrime adversaries continued to prove their ability to adapt, splinter, regroup and flourish in the face of defensive measures. After some of the biggest and most notorious ransomware enterprise shutdowns, ransomware affiliates moved to new ransomware-as-a-service (RaaS) operations. Additionally, more than 2,500 advertisements for access were identified across the criminal underground, representing a 112% increase compared to 2021 and demonstrating a clear demand for access broker services. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/KQGZLF/ Workshops & Speed Andrew Munchbach PUBLISH 9BXV9C@@cfp.hackfest.ca -9BXV9C Ultimate Test Drive - Next-Generation Firewalls en en 20231013T120000 20231013T133000 013000

Ultimate Test Drive - Next-Generation Firewalls

///EN . Learn to ensure application access is by user-IDs. . Configure Cloud Identity Engine for authentication and identity/User-ID. . Create application-based policy with Policy Optimizer. . Setup granular control for Social Media and Sanctioned SaaS Applications. . Add new decryption policies to decrypt SSL (TLS 1.3) traffic. . Create a custom report in the Application Command Center. . Learn to use the new AIOps dashboards. All you need is your own laptop with Internet access. ///FR . S'assurer que les accès aux applications sont contrôlés par UserID. . Utiliser le service Cloud Identity Engine pour l'authentification et identité UserID. . Créer des politiques de sécurité applicatives via le Policy Optimizer. . Créer des contrôles granulaires pour les applications des réseaux sociaux et SaaS. . Ajouter des politiques de déchiffrement SSL (TLS 1.3). . Générer des rapports personnalisés dans l'Application Command Center. . Apprendre à utiliser les tableaux de bords d'AI Ops. Tout ce dont vous avez besoin est de votre ordinateur portable avec accès à l'Internet. PUBLIC CONFIRMED Workshop - 120 minutes https://cfp.hackfest.ca/hf2023/talk/9BXV9C/ Workshops & Speed Guillaume Roy PUBLISH 7NFLVW@@cfp.hackfest.ca -7NFLVW CORTEX XPANSE CAPTURE THE FLAG: Where in the World are Your Exposures? en en 20231013T133000 20231013T143000 010000

CORTEX XPANSE CAPTURE THE FLAG: Where in the World are Your Exposures?

Step into the exciting world of the Cortex Xpanse Capture the Flag challenge! This game invites participants to journey through the Expander UI, tackling a series of intricate challenges. For each challenge conquered, players will be rewarded with a "flag" and earn valuable points. The ultimate glory goes to the team or individual who unravels the most mysteries and accumulates the highest score. By participating, you not only get a hands-on experience with Cortex Xpanse but also indulge in a fun, immersive competition. This event is tailored to both seasoned pros and enthusiastic newcomers. Are you up for the challenge? Dive in, learn, compete, and emerge victorious! This game, with a duration of one hour, calls on participants to explore the Expander interface. Make sure to bring your laptop to take part in this challenge. ========= Entrez dans l'univers palpitant du défi Capture the Flag de Cortex Xpanse! Ce jeu invite les participants à s'aventurer dans l'interface Expander, en affrontant une série de défis élaborés. Chaque défi surmonté récompensera les joueurs avec un "drapeau" et leur permettra de gagner des points précieux. La gloire suprême est décernée à l'équipe ou à l'individu qui dévoile le plus de mystères et obtient le score le plus élevé. En participant, vous bénéficiez non seulement d'une expérience pratique avec Cortex Xpanse, mais vous vous immergez aussi dans une compétition amusante et immersive. Cet événement est adapté aussi bien aux professionnels chevronnés qu'aux novices enthousiastes. Êtes-vous prêt à relever le défi? Plongez, apprenez, concourez et triomphez!" Ce jeu, d'une durée d'une heure, sollicite les participants à explorer l'interface d'Expander. Assurez-vous d'apporter votre ordinateur portable pour participer à ce défi. PUBLIC CONFIRMED Workshop - 120 minutes https://cfp.hackfest.ca/hf2023/talk/7NFLVW/ Workshops & Speed Patrick Hamel PUBLISH ZTQ7DM@@cfp.hackfest.ca -ZTQ7DM How a Global Retail Hack Breathed Life Into Static Security Analysis en en 20231013T143000 20231013T145000 002000

How a Global Retail Hack Breathed Life Into Static Security Analysis

DESCRIPTION [Presentation Flow] 1...Introductions and Presentation Title - 1 min. 2...Laying Out the Problem Statement - 3 min. 3...Tool Demo - 2 min. 4...Capabilties and Use of Graph Theory - 5 min. 5...Virtual Reality Plug-In - 2 min. 6...Feasibility Study - 3 min. 7...Graph Theory - 2 min. 8...Conclusion, Invite Audience Members to Use Oculus Headset and Visualize (if permitted by Hackfest) - 2+ min. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Introductions and Presentation Title] My co-speaker and I will introduce ourselves. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Laying Out the Problem Statement] We draw the crowd in by telling the story of a security incident we were involved in for a retail company. We will describe the hunt for the elusive root cause during which we combed through application scanning reports that were generated in the last code review. We pulled it up, hoping it would provide the answers we needed. But we scrolled through the 1000+ page report, it became clear that it would take too long to manually analyze the data. Determined to find a solution, we began exploring different ways to analyze the application report data. We tried sorting it by severity, looking for patterns and trends, and manually creating visualizations, but nothing seemed to provide the insight we needed. That’s when we stumbled on this research idea that promised to revolutionize one part of the way we solve cyber incidents. In consequence, we developed ASTRA – Abstract Syntax Tree Reader and Analyzer. By leveraging graph theory and advanced data visualization techniques, the solution could transform the complex application data into easy-to-understand visualizations that would highlight the most critical vulnerabilities. ASTRA builds an explorable world from endless reports of security documentation. When we run these reports through ASTRA code, the data is re-shaped into a graph. We turn the application’s files into the graph nodes while the lines in the graph (called graph edges) represent a connection between two files. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Tool Demo] We will play the GraphViz graphical representation and interact with it live in front of the Hackfest audience. The result of ASTRA is this visual representation of the application geometry. I can see the files come alive. I can interact with the most vulnerable files and see how they’re connected. The thicker the graph edge, the higher the number of vulnerabilities are being exchanged between the two files. Instead of being tailored to answer a specific question, the beauty of the graph visualization is that it’s just the platform on which anyone can bring their domain expertise, their lens, and their hypotheses. Being set free to explore the application and bringing in more humanity to cyber analysis. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Capabilities and Use of Graph Theory] Our users can filter by how much certain files contribute to and bring down the security health of the application. We can automatically draw lines around the number of clusters or communities for the graphs and use anomaly detection to find surprising or unusual occurrences. The takeaway is that seeing and feeling the application geometry unlocks key security information. During the live demo at Hackfest, we will run ASTRA on the architecture of the problematic application mentioned at the beginning of the presentation. The client was notified of faulty encryption. Now, instead of looking for it in a 1000-page report, we have the luxury of hovering our cursor over the encryption file. And seeing which files it’s connected to. Here, we see that the culprits jump out at us. Our use cases expand beyond conducting a root cause analysis. ASTRA is an accelerator to architecture mapping and threat modeling. It engages developers in security awareness programs and enhances the application security tools that many organizations already use. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Virtual Reality and Demo of Virtual Reality Experience] What if we push the envelope even further? What if we could take anything you could experience on a screen and stretch it into your entire field of vision. Enter virtual reality where now we interact with the data as if we are a file on this graph, or maybe … you’re even the attacker’s payload. With VR we can walk around in this world and interact with the once lifeless words in a thousand-page report. In this way we can shine a light on insights that were locked away in piles of information. Turning our attention to our screens, the main source file has many critical vulnerabilities, and we can see all of the other folders that it calls. The value in ASTRA is when it forces us to notice what we never expected to see. Here, we will be providing our own Oculus headset for audience members to try out. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Feasibility Study] If cyber-crime were a country, it would have the third largest GDP in the world, at $6T dollars in 2021 and growing. So it’s not a surprise there’s a sizable market for defensive cyber tools. Application security tools have a market of $6B and this is the market we’re playing within. We see ASTRA as bundled with an existing application security tool. ASTRA also satisfies the market trending toward automation. From our own study at a large French-Canadian bank, we found automation in threat modeling can reduce cycles by 35%. Adapting data to ASTRA, we can settle on a conservative ROI of 30%, which means 30% less human time spent on threat modeling, that can be channeled toward productive tasks. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Novelty] To be clear, graph theory has never been applied before to application security vulnerability analysis. We conducted a literature review and market analysis, including interviews with subject matter experts. The use of graph theory for application security is not currently a feature in any tool on the market, nor in any paper, which we think could increase market attractiveness. Our ASTRA technical fundamentals scale to 6000x. That is, our virtual reality simulation would only slow down at 70,000 connections or 6,000 files. The way forward for us is to make it better by bringing in more features, like color coding files in VR. ASTRA was designed to help visualize threats, but our software can be applied to graphically visualize other kinds of attacks, like those over a network or hardware attacks like IOT devices. Our key takeaways are that we can adopt the mindset of genuinely engaging with developers in addition to relying on text-based reports. Graph Theory has never been applied before in vulnerability analysis and we are looking forward to what benefits ASTRA could bring. ----------------------------------------------------------------------------------------------------------------------------------------------------------------- [Conclusion] Future of work As people we have an innate desire to explore and learn on our own. We hope that vision behind ASTRA brings us all one step closer to that future of work. If permitted by Hackfest, we will encourage enthusiastic audience members to come up and experience the virtual reality SAST visualization using a sanitized Accenture-owned Oculus headset that we will provide. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/ZTQ7DM/ Workshops & Speed Naeem Budhwani PUBLISH ASRMBB@@cfp.hackfest.ca -ASRMBB Cryptojacking: Defending against cloud compute resource abuse en en 20231013T150000 20231013T152000 002000

Cryptojacking: Defending against cloud compute resource abuse

Introduction [3 minutes] As Cloud computing evolves, adversaries can take advantage of new attack surfaces and services. The threat actors are deploying sophisticated campaign strategies to abuse millions of dollars in cloud computing in compromised tenants and subscriptions while avoiding detection. Microsoft's research reveals that targeted organizations faced more than $300,000 in compute fees from cryptojacking attacks. In this presentation, we will share the discovered TTPs (Tactics, Techniques, and Procedures) that we observed in numerous organizations executed by several threat actor groups. Cryptojacking Anatomy [15 minutes] Cloud cryptojacking/abuse follows a similar attack lifecycle regardless of the cloud provider. We will dissect the inner workings of cloud these attacks. As we move from the initial access stage to the impact stage, we will explore key TTPs. By analyzing footprints and logs, we will provide insights that blue teamers can use to detect and counterattack these threats especially at early stage of attacks. 1. Initial access - Compromised credentials: Threat actors need compromised credentials with Virtual Machine contributor role to execute attacks, making credential hygiene and cloud hardening crucial. In most of the cases, the compromised accounts did not have multi-factor authentication (MFA) enabled. After gaining access, some threat actors use attacker-controlled virtual machines within legitimate tenants as their operational infrastructure. By using living-off-the-land techniques, threat actors can operate without any infrastructure external to the cloud environment. 2. Privilege escalation - Elevating access: In some cases, threat actors compromise the global administrator account. Global administrator accounts may not possess access to all subscriptions and management groups in the directory; to gain permissions over all resources, the 'elevate access' option must be activated for the account. 3. Defense evasion - Subscription hijacking: Once the threat actor compromised the tenant and performed reconnaissance to determine available permissions, the attacker may proceed to transfer (hijack) the subscription to another tenant (attacker-controlled). Subscription hijacking is an evasion technique that allows the threat actor to hide some of their activities from the tenant administrator and security teams. Subscription hijacking is disruptive forensically as all activity logs are stored at subscription level and there would be no events for incident response teams. 4. Impact - Increasing core quotas: To boost the cloud compute abuse, the threat actors often increase the Virtual Machine core quota to deploy massive amounts of computing power. GPU compute offerings are often targeted by threat actors. GPU compute provides access to high performance NVIDIA and AMD GPU cores, allowing cryptocurrency mining magnitudes more effective than any CPU compute offering. 5. Impact - Deploying compute: Malicious provisioning behavior of compute generally does not match existing compute provisioning patterns within the tenant. Threat actor ultimately needs to provision compute very quickly to make the attack profitable. This time restriction means that patterns in provisioning generally emerge over relatively short periods of time. 6. Impact - Mining cryptocurrency: Once subscription is compromise and the compute is created, the threat actor can begin mining cryptocurrency by deploying mining software to the newly created VMs. The installed mining software joins the VM to a mining pool, which allows the threat actor to pool their stolen processing power from multiple compromised tenants. Threat actors may need to install GPU drivers to take full advantage of the graphics card, especially on N-series VMs. Actors have been observed abusing Azure Virtual Machine extensions such as an NVIDIA GPU Driver Extension for Windows or Linux, or an AMD GPU Driver Extension for Windows, to facilitate driver installation. Key Take away for: 1. Blue Teamers and threat hunters: Take in new TTPs observed by Microsoft experts on several compromised cases and practical information to build high fidelity detections. 2. Red Teamers: Get up to speed with related techniques used by ATPs (Advanced persistent threat) which are tracked by Microsoft security experts. 3. GRC and Management: Understanding of strategies to strengthen cloud security postures, protect cloud workloads, and defend against a wide range of cloud-based threats and risks. Questions [2 minutes] PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/ASRMBB/ Workshops & Speed Amir Gharib PUBLISH GVFX3J@@cfp.hackfest.ca -GVFX3J Les nouveaux "Business" du blackmarket fr fr 20231013T153000 20231013T155000 002000

Les nouveaux "Business" du blackmarket

Dans un monde où le marché noir est en expansion constante, il devient essentiel pour les professionnels de la cybersécurité, des chefs d'entreprises ou du "simple" citoyen de comprendre les défis qui se présentent dans ce secteur illicite. La conférence explorera les stratégies et les tactiques utilisées par les acteurs du marché noir pour promouvoir et vendre leurs produits et services (faux papiers, failles, accès, brokers, Etc). Comprendre leur fonctionnement pour mieux s'en protéger ! Points clés abordés : Introduction au marché noir : définition, tendances actuelles et enjeux. [2mns] Les acteurs du marché noir : comprendre leur motivation et leurs cibles. [2 mns] Techniques de marketing illicites : publicité clandestine, vente en ligne anonyme, vol de bus, promotions, concours (gagner 5 grammes de cocaïne ; ...) [10 mns] Études de cas : exemples concrets de campagnes de marketing dans le black market. [5 mns] Objectifs de la conférence : Comprendre les stratégies et les tactiques de marketing utilisées dans le marché noir. Sensibiliser aux risques liés à ces pratiques. Encourager la réflexion et les débats sur la réglementation et la lutte contre le marché noir. Public cible : Cette conférence s'adresse aux professionnels du marketing, aux entrepreneurs, aux juristes, aux étudiants, ainsi qu'à tous ceux qui souhaitent comprendre les dynamiques et les enjeux du marketing dans le marché noir. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/GVFX3J/ Workshops & Speed Damien Bancal PUBLISH GHPW9Y@@cfp.hackfest.ca -GHPW9Y Ultimate Test Drive - Cloud Delivered Security Services en en 20231013T160000 20231013T173000 013000

Ultimate Test Drive - Cloud Delivered Security Services

///EN Experience the value firsthand and see how you can: . Prevent 60% more unknown injection attacks that traditional IPS solutions miss. . Stop 26% more zero-day malware than traditional sandboxes. . Apply predictive analytics to disrupt attacks that attempt to exploit DNS traffic to cause harm. . Detect and prevent 40% more threats than traditional web filtering databases with inline machine learning (ML)-powered web security that blocks new and evasive malicious websites. . Discover 90% of devices in the first 48 hours and expand visibility to all devices for IT and security teams – even devices never seen before. All you need is your own laptop with Internet access. ///FR Apprenez comment protéger votre réseau et détecter les attaques inconnues et zero day 180x plus rapidement qu'avec toute autre plateforme et ce, avec une console centralisée de gestion. . Prévenir 60% plus d'attaques d'injections que les solutions IPS traditionnelles. . Bloquer 26% plus d'attaques zero day de logiciels malveillants que les solutions de détonation traditionnelles. . Appliquer des techniques d'analyses préventives sur les attaques exploitant le traffic DNS. . Détecter et prévenir 40% plus de menaces évasives avec l'apprentissage machine (ML) que les solution traditionnelles de filtrage URL. . Découvrir 90% des équipements réseaux lors des premières 48h et continuellement augmenter la visibilité de vos équipements de l'Internet des objets. Tout ce dont vous avez besoin est de votre ordinateur portable avec accès à l'Internet. PUBLIC CONFIRMED Workshop - 120 minutes https://cfp.hackfest.ca/hf2023/talk/GHPW9Y/ Workshops & Speed Guillaume Roy PUBLISH 8B3QB8@@cfp.hackfest.ca -8B3QB8 GamePwn 101 - Introduction to Game Hacking en en 20231014T090000 20231014T095000 005000

GamePwn 101 - Introduction to Game Hacking

This talk will be divided into the following five sections. 1) What is game hacking? This section serves as a brief introduction to game hacking. I will explain that game hacking involves modifying game code, data, or mechanics to gain an unfair advantage or access hidden content. I will also explore the motivations behind game hacking, such as achieving high scores, gaining prestige, or economic incentives in online games. The importance of understanding game hacking within the broader context of information security is emphasized. 2) Real-world examples of game hacking (cheats, bots, exploits) This segment showcases a range of real-world examples to illustrate the impact of game hacking. It covers cheats like aimbots, which provide enhanced aiming abilities, wallhacks that allow players to see through walls, and speed hacks that increase movement speed. The discussion also highlights the usage of bots for automated gameplay and farming resources. Additionally, it delves into exploits, such as duplication glitches or accessing restricted areas. Each example is explained in detail, discussing how they disrupt fair play and affect player experiences. 3) Common game hacking methods This section provides an in-depth exploration of the common methods employed by game hackers. It starts with memory editing, where hackers manipulate values stored in a game's memory to gain advantages like infinite health or unlimited resources. Code injection is then explained, involving the injection of custom code into a game's executable to modify its behavior. The discussion further includes techniques like packet manipulation, where network packets are intercepted and modified to gain unfair advantages. The inner workings of each method are described, emphasizing the technical aspects and their implications for game security. 4) Anti-cheat measures Here, the focus shifts to the countermeasures implemented by game developers to combat cheating. Encryption is discussed as a means to protect game data and prevent unauthorized access. Client-server validation is explained, involving checks performed between the game client and server to detect inconsistencies and cheating attempts. The role of behavior monitoring systems in identifying suspicious player actions is highlighted. Continuous updates are emphasized as a crucial aspect of anti-cheat measures to patch vulnerabilities and stay ahead of hackers. The discussion also touches on the challenges faced by developers in balancing security measures with player experience. 5) Future of game hacking The final section explores the future landscape of game hacking within the broader context of information security. I will discuss emerging technologies and trends that may shape game hacking, such as the integration of artificial intelligence and machine learning. The potential impact of blockchain technology on securing in-game economies and preventing cheating is examined. The importance of ongoing research, collaboration among game developers, and the adoption of innovative security measures is emphasized to mitigate evolving threats in the dynamic world of game hacking. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/8B3QB8/ Track #1 James Li PUBLISH WQMGUN@@cfp.hackfest.ca -WQMGUN Lessons from LastPass: Beyond Secure Password Management en en 20231014T100000 20231014T105000 005000

Lessons from LastPass: Beyond Secure Password Management

We hear it all the time - secure your passwords best with an application dedicated to just that. LastPass is a popular password manager used from individuals through corporate levels. However, in 2022 it suffered two breaches, and only recently was the extent of the damage made known. An unknown attacker was able to take the literal keys to the kingdom, compromising everything stored in the LastPass vaults. We will examine what was made known by LastPass and the media as we walk through the details available on both attacks. We will walk through the timeline of events and disclosures because it's important to note what came to light when, and how that changed the narrative. We will also examine the role played by BYOD, logging, and why we need to change with the times to detect behavoral anomalies. This talk is presented in a "Lord of the RIngs" theme OUTLINE Password Managers: What and Why - What they are and why we need to use them What Could go Wrong - A timeline of who's been hacked and multiple occurrences - My personal experience using LastPass and switching to Bitwarden LastPass: What Did go Wrong - A basic anatomy of attack and timeline of events to show how what was stolen in Attack 1 was used in Attack 2 - They took both encrypted and unencrypted data - They took data on browsing habits of users - The engineer used his own device to access his corporate vault. - This happens far more than we realize and we cannot effectively secure A Tale of 2 Attacks - A detailed discussion of what was discovered against what statements were made by LastPass over the months following the attacks - Highlight where perceived security failed - Call out how the crucial time to act at the beginning was lost Key Takeaways - Dwell Time matters - BYOD – how do you manage - Leverage logging and alerts - Track for behaviour and anomalies - What’s accessible in your dev environment - Attacks are evolving past our defences PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/WQMGUN/ Track #1 Cheryl Biswas PUBLISH XARKMK@@cfp.hackfest.ca -XARKMK Hacking Reality: CounterCloud's AI-Driven Disinformation Campaign en en 20231014T110000 20231014T115000 005000

Hacking Reality: CounterCloud's AI-Driven Disinformation Campaign

This presentation aims to provide an in-depth exploration of CounterCloud, a groundbreaking autonomous AI system designed to generate and disseminate disinformation. Part 1 | “Liar Liar, Pants on Fire.” The talk will kick off with an overview of the current landscape of AI in disinformation campaigns, highlighting specific case studies and limitations. At this point, nearly all AI-based disinformation campaigns require human interaction and support. So, if we could remove as many humans from the equation, the AI system could operate much faster. The presentation will then introduce CounterCloud, from its architecture and technical aspects to its ethical implications and potential risks. Part 2 | “Deus Ex Machina” The presentation will then dissect how CounterCloud uses large language models like ChatGPT to autonomously scrape, generate, and distribute disinformation at scale. It will cover the system's architecture, including its backend setup, the role of cloud computing, and the gatekeeper module that decides what content to target. The output capabilities of CounterCloud, such as generating fake articles, comments, images, and social media posts, will also be discussed in detail. Part 3 | “The Wolf at the Door?” Concluding the talk, the focus will shift to the public’s response to the experiment. First broken to the public in an article from The Debrief, and also covered by Wired, the presentation will shift to the social reaction to, ethical considerations of, and risks associated with autonomous AI disinformation systems like CounterCloud. Whether one thinks this is awesome tech or the end of the world as we know it, this experiment proves mass AI-powered disinformation is possible. So now what? The presentation will emphasize the need for public awareness, regulatory challenges, and potential ethical solutions to mitigate the risks. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/XARKMK/ Track #1 MJ Banias N PUBLISH MXJBJB@@cfp.hackfest.ca -MXJBJB Enchantment under the C en en 20231014T133000 20231014T142000 005000

Enchantment under the C

Linda: Yeah Mom, we know, you've told us this story a million times. You felt sorry for him, so you decided to go with him to The Fish Under the Sea Dance. Lorraine: [thoughtfully, remembering] No, it was The Enchantment Under the Sea Dance. Our first date. I'll never forget, it was the night of that terrible thunderstorm, remember George? [He's not listening, completely focused on the show.] Your father kissed me for the very first time on that dance floor. It was then I realized I was going to spend the rest of my life with him. [Again, George laughs at the show, Marty and Linda exchange a look.] PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/MXJBJB/ Track #1 Patrick Kendra Cooley PUBLISH 9MHUNS@@cfp.hackfest.ca -9MHUNS Artificial Intelligence / Real Threats en en 20231014T143000 20231014T152000 005000

Artificial Intelligence / Real Threats

After the initial Title and Introduction slides the presentation: - Layout: Talking about what we are talking about. Giving the audience the basic layout of the talk and what we'll be covering. All high level info but sets expectations for the talk. - History: Recapping how we got to this point and our (new) problem. - Video: Covering video AI technology, real world attacks examples, and means to leverage the tech to prepare for attacks. - Audio: Covering audio (voice) AI technology, real world attacks examples, and means to leverage the tech to prepare for attacks. - Text/Code: Covering the use of text AI in social engineering attacks and development efforts. - Recap: Running over the key takeaways again in the hope that something sticks. - Thanks + A fun Q&A PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/9MHUNS/ Track #1 Johnny Xmas Chris Carlis PUBLISH BHXGYC@@cfp.hackfest.ca -BHXGYC Cloud environments: Red Team perspectives fr fr 20231014T153000 20231014T162000 005000

Cloud environments: Red Team perspectives

Cloud computing has become an integral part of modern infrastructure, offering scalable and flexible solutions for businesses. However, this new paradigm brings its own set of security challenges. This presentation aims to explore the Red Team perspectives in cloud environments, focusing on various aspects such as intrusion testing, shared security models, and the unique vulnerabilities and attack vectors associated with cloud-based systems (AWS/GCP/Azure). This presentation will introduce the concept of cloud intrusion testing and its significance in today's technological landscape, from the perspective of an attacker or Red Team operator. Standards and frameworks will be discussed to provide a comprehensive understanding of its purpose, objectives, and main differences compared to more classic approaches such as network, web application, mobile, and wireless intrusion testing. Emphasis will be placed on the heavy reliance on Identity and Access Management (IAM) as a crucial factor in enabling or restricting actions within cloud environments. The reasons for conducting intrusion tests and Red Team engagements in cloud environments will be outlined, highlighting similar attack surfaces to web applications or external networks. Additionally, the potential access to critical resources will be addressed, including development pipelines, CI/CD systems, sensitive data backups or storage, user accounts synchronized with on-premise domains, synchronization with on-premise Active Directory servers, and management of devices and computers through services like Azure Hybrid Joined and Intune. Furthermore, applied methodologies for assessing and testing the security posture of cloud environments will be proposed, offering three distinct approaches or positions: BlackBox, AssumBreach, and White Box. These approaches will provide the audience with practical guidance on how to approach cloud environment assessments and intrusion testing engagements. Subsequently, TTPs (Tactics, Techniques, and Procedures) and attack scenarios based on the Mitre Att&ck Cloud Matrix framework will be presented, covering enumeration/discovery, initial access, persistence, and impact. Examples will range from password spray limitation bypass to S3 Ransomware detonation. Expanding the scope of the discussion, the concept of the cloud as an offensive tool in Red Team operations and social engineering will be explored. Examples of cloud-based phishing approaches and the offensive use of cloud resources will be presented. Finally, the emerging field of Purple Team within the cloud environment will be briefly touched upon. Collaborative approaches that bring together Red and Blue Teams to enhance cloud security will be discussed. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/BHXGYC/ Track #1 Clément Cruchet PUBLISH KBCULM@@cfp.hackfest.ca -KBCULM Smart Contracts, Not So Smart Bugs: Crypto Domain Takeovers en en 20231014T163000 20231014T165000 002000

Smart Contracts, Not So Smart Bugs: Crypto Domain Takeovers

Introduction to Dexs (Decentralized Exchanges) - What are some of the largest Dexs and why are they used? - Uniswap, PancakeSwap, Sushiswap all allow users to trade tokens without having to use a centralized intermediary like Coinbase or Kraken - Users might not want to KYC (share identity) or want to purchase a token that's not listed on an exchange (HarryPotterObamaSonic10Inu) - These organizations are often DAOs (decentralized autonomous organizations) and so development is public on Github. - What does the user experience look like? - Metamask - prompt to approve tokens, then approve to swap. Introduction to NextJS / Vercel - Many projects in the space are using the NextJS Javascript framework because it integrates well with common Web3 libraries (like Ethers.js) - Vercel is a product from NextJS that is something like a CI/CD pipeline for a frontend - Each pull request gets a preview deployment - Changes merged to main get a production deployment Discovering Vulnerability #1 - Vercel Bugs - March 2022: A bug in Vercel allowed an attacker to drain $320.000 from EVODeFi, so I began investigating how this might have happened - It turned out many crypto projects were using Vercel so I decided to take a closer look. If a malicious user took over a Dex, it would be trivial to trick users into approving malicious contracts. - YearnFi - linked to a Vercel deployment in their Github repositories. - I took over crv.ape.tax; yearn-hub.vercel.app; other deployment URLS - Reward: $500 DAI (had to reach out on Keybase, ImmuneFi did not help) - Uniswap - Took over uniswap-frontend-beta.vercel.app - No reward - Sushiswap - Took over full domain of Sushiswap.fi and was able to increase impact by adding mail records - Reward: 100 Sushi not from the foundation, unofficially via Discord - *.finance - Since most DeFi sites used finance domains, I scanned the entire zone file for dangling Vercel domains. - Took over domains of some defunct projects. Unable to return these to their rightful owners. Discovering Vulnerability #2 - Onename - Onename.io was used to translate user handles into Bitcoin addresses - Previously hosted on Heroku - DNS was dangling so it was able to be taken over - Many high profile twitter users had linked to this service, including crypto CEOs. As an attacker this would be extremely useful for phishing. - Reported to HackerOne: $100 bounty Conclusion - Just start hunting and learning - these bugs did not require uber 1337 hacking skills - Think about your threat model - don't get stuck thinking of the most complicated exploit scenario when dangling DNS is simple yet impactful - Crypto and Infosec people should talk more instead of fighting with each other :) PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/KBCULM/ Track #1 Michael Be PUBLISH WVDD9Y@@cfp.hackfest.ca -WVDD9Y Hackfest Closing Ceremony en en 20231014T170000 20231014T175000 005000

Hackfest Closing Ceremony

Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/WVDD9Y/ Track #1 Hackfest Communication PUBLISH SKGTQ9@@cfp.hackfest.ca -SKGTQ9 La meilleure cyberdéfense, c'est l'ATT&CK® fr fr 20231014T090000 20231014T095000 005000

La meilleure cyberdéfense, c'est l'ATT&CK®

Outillez votre cyberdéfense en apprenant à naviguer dans la matrice des tactiques et techniques utilisées par les cybercriminels et leurs écosystèmes ! Cette présentation intéressera autant les gestionnaires que les professionnels de la cybersécurité et de la gouvernance de la sécurité de l'information souhaitant développer leurs connaissances du domaine des opérations de cybersécurité. Depuis ces dernières années, le MITRE ATT&CK® s'est immiscé dans les opérations de cybersécurité au point de devenir un standard de facto. Les éditeurs de solutions de cybersécurité l’ont compris et intègrent de plus en plus cette approche dans leurs produits. Qu’en est-il de vos pratiques de cybersécurité ou de celles de votre fournisseur de services cybersécurité gérés ? Que vous soyez impliqué dans la cybersécurité offensive ou défensive, apprenez comment penser comme un pirate informatique, comprendre sa motivation, ses actions et ses outils avec l’approche MITRE ATT&CK® et D3FEND®. Que vous fassiez partie d’une grande entreprise ou d’une PME, prenez conscience de l’importance de connaitre les faiblesses de votre cyberdéfense, et d’identifier vos besoins afin d’acquérir les technologies appropriées pour y répondre. Que vous disposiez des ressources ou que vous fassiez appel à un fournisseur de services gérés en cybersécurité, découvrez comment vous assurer de disposer de l’expertise ou des services pour détecter et de répondre aux incidents selon votre contexte. Levez le voile sur l’opérationnalisation de ce qui n’est ni un produit ni une technologie dans les pratiques de cyberenseignement (CTI), chasse aux cybermenaces (TH) et simulations de cyberattaques (AE) ou encore comment renforcer la valeur du centre de gestion des opérations de cybersécurité (SOC). Clarifier l’intégration de l'approche MITRE ATT&CK® dans votre stratégie globale de sécurité de l'information en évaluant votre posture de cyberdéfense afin d'aligner vos contrôles avec les mécanismes de détection et de réponse requis. Enfin, appropriez-vous l’écosystème en ligne et les nombreuses ressources disponibles pour vous former ou vous faire certifier dans le cadre du programme MITRE ATT&CK Defender™ (MAD). PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/SKGTQ9/ Track #2 Christophe Reverd PUBLISH XRQDEH@@cfp.hackfest.ca -XRQDEH Between a Log and a Hard Place: (mis)Adventures in Azure Logs en en 20231014T100000 20231014T105000 005000

Between a Log and a Hard Place: (mis)Adventures in Azure Logs

Security monitoring in any environment is made or broken by the signal quality in the event logs. Cloud-based solutions have transformed the computing landscape with advantages like on-demand resource availability, scalability, cost-effectiveness, and enhanced collaboration capabilities. For defenders, this new world offered many benefits: robust identity management, patching at scale, improved incident detection and response, and more. Cloud providers expose detailed logs that are consumed by security monitoring tools and SOC analysts. One would expect a common, streamlined logging solution to be a clear win in attack detection functionality, but the reality is more complicated. We have spent the last three years studying and monitoring Azure logs and have seen many problems that can complicate incident detection and response. With no alternatives to the provider's logging solution and slow problem mitigation speed, these issues go beyond mere annoyances and can help attackers avoid detection. In this talk, we will examine logging facilities in Azure, concentrating on events generated by Azure AD and Microsoft 365, and discuss multiple problems that we have observed in monitoring them. These include: - Blind spots hiding critical security events - Poorly documented events, attributes and magic values - Missing important information about user actions - Bugs in log records - Unannounced changes that break detection queries - Log pollution opportunities, potentially leading to RCE - and more For all these issues, we will: - examine their impact on defense and monitoring - discuss how attackers (and red teamers) may take advantage of them - suggest how defenders can mitigate the negative impact, where possible - and propose ways the cloud provider can address the problems going forward PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/XRQDEH/ Track #2 Dmitriy Beryoza PUBLISH Y8VWXL@@cfp.hackfest.ca -Y8VWXL It was harder to sniff Bluetooth through my mask during the pandemic... en en 20231014T110000 20231014T115000 005000

It was harder to sniff Bluetooth through my mask during the pandemic...

Quisque et neque a est gravida venenatis. Nullam finibus diam tellus, quis tristique ligula hendrerit eu. Cras ante justo, ornare euismod rhoncus non, dictum vitae ipsum. Sed sit amet molestie sapien. Curabitur eu quam quis massa venenatis convallis. Sed sit amet magna quis sem venenatis molestie. Proin id urna dolor. Pellentesque at tempor orci, quis faucibus elit. Duis gravida eu mi non euismod. Donec sit amet erat sed ante varius egestas nec eget dolor. Ut imperdiet enim maximus mi euismod, vel tincidunt sem blandit. Phasellus a fermentum est. Donec scelerisque felis nec lobortis sagittis. Nulla diam dui, sagittis non turpis. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/Y8VWXL/ Track #2 Xeno Kovah PUBLISH 8ZYFHT@@cfp.hackfest.ca -8ZYFHT NOTH1NG T0 HID3 en en 20231014T133000 20231014T142000 005000

NOTH1NG T0 HID3

1. Confusion of the inverse logical fallacy (all criminal activity is hidden, so all that is hidden must be criminal). 1a. Schrödinger's video camera 2. Why is privacy important (actual rebuttals to "if you're doing nothing wrong, you've got nothing to hide") 2a. Data hoarding → Blackmail, impersonation 2b. Today’s authority might become totalitarian or inhumane 2c. Herd immunity: many people not hiding anything, make the few stand out more and cause (misplaced) suspicion 3. What do "normal people" have to say? What reactions have I've been getting since my previous version of the talk on a similar topic? 4. Real examples of privacy nightmares. 4a. China & Hong Kong (all the weird stuff) 4b. Facebook (court rulings, suicide prevention algorithm) 4c. EU (cookies, GPDR) 4d. UK 5. The end of end-to-end encryption 6. Stories from the privacy zealot (How to achieve privacy and how much it cost me) 6a. Mobile apps 6b. IT certification exams 6c. Airport scanners 6x. more examples to follow 7. Specific examples of where we were able to fix privacy 7a. And where we failed (this is sadly larger than (6)) 8. Summary — do we fix it or what? PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/8ZYFHT/ Track #2 Kirils Solovjovs PUBLISH K7SXNK@@cfp.hackfest.ca -K7SXNK Des pilules pour maigrir? L’OSINT pour démasquer un réseau international de fraude en ligne fr fr 20231014T143000 20231014T152000 005000

Des pilules pour maigrir? L’OSINT pour démasquer un réseau international de fraude en ligne

La présentation se veut une introduction à l’OSINT et une démonstration d’une enquête effectuée pour une émission journalistique. Intro : Gino Chouinard vend des pilules ?!? L’équipe de l’émission d’enquête J.E. de TVA nous a approchés pour les aider à dénicher les responsables d’une campagne de fraude qui utilise l’image de vedettes de l’empire Québecor pour votre des pilules. Ces annonces sont diffusées via Facebook et renvoient vers des pages hébergées sur des sites Web clonés. Ces sites Web envoient ensuite les visiteurs vers une multitude de magasins en ligne qui proposent des produits amaigrissants, des produits naturels et autres. Lorsqu’on achète un produit sur ces sites, on s’en fait envoyer plus que ce qu’on a demandé et les factures gonflent rapidement. En introduction, je veux donc exposer les grandes lignes de la fraude. 1: Le Cycle du renseignement ou comment ne pas se perdre dans les terriers de lapin. La différence entre l’OSINT et « fouiller sur Google » c’est le Cycle du renseignement. Débuter avec une question claire et un plan pour y répondre permet de ne pas se perdre. Ce concept qui vient du renseignement est utile pour l’OSINT dans toute sorte de contextes, que ce soit en threat-hunting, en journalisme ou dans un CTF. 2: C’est quoi l’OSINT ? L'OSINT, c’est du renseignement de sources ouvertes. C’est une méthode de travail passive et « sans contact ». On ne laisse rien derrière et on ne prend que des « screenshots ». L’OSINT regroupe plusieurs sous-spécialités : les réseaux sociaux, la géolocalisation, les transports aériens, maritimes et autres, les enquêtes sur les personnes ou les entreprises, les infrastructures réseau. Il y a quelques précautions à prendre avant de se lancer dans ce genre d’enquête. Nous allons aborder celles-ci de façon rapide : « sock puppets », VPN, machine virtuelle, prise de notes et préservation de l’information. 3: Qui se cache derrière ces annonces ? À l’aide des données obtenues de la part de personnes ayant été fraudées, nous avons cartographié le réseau utilisé pour ce stratagème : les sites Web, les serveurs, les entreprises, les individus. L’opération a pu être divisée en deux grands groupes. D’un côté, un réseau de sites Web servant à pousser des annonces frauduleuses sur Facebook et diriger du trafic vers des magasins en ligne. De l’autre, le réseau de magasins en ligne, à l’apparence indépendants, mais tous liés les uns aux autres. Grâce à une petite erreur de sa part, nous avons réussi à relier le premier pan de cette opération à un individu. Une photo de son chien nous a finalement mis sur la piste de son adresse de résidence. 4: Conclusion Les participants et participants à cette conférence en sortiront avec une meilleure compréhension de l’OSINT et de son application. Ils comprendront l’importance du cycle du renseignement pour structurer la recherche et travailler de façon efficace. PUBLIC CONFIRMED Regular Talk https://cfp.hackfest.ca/hf2023/talk/K7SXNK/ Track #2 Sam Harper PUBLISH 7FMB8N@@cfp.hackfest.ca -7FMB8N Web Scraping Unleashed: Mastering Techniques for Data Harvesting en en 20231014T100000 20231014T102000 002000

Web Scraping Unleashed: Mastering Techniques for Data Harvesting

This talk presents a brief introduction to various techniques for scraping websites using the Python programming language. Web scraping refers to the automated process of extracting data from websites using software tools or scripts. Web scraping allows you to gather data from multiple sources on the internet and collect it in a structured format for analysis, research, and other purposes. There are numerous legitimate uses for scraping websites, notably content aggregation, research and data analysis, job searching, social media analysis, and legal/compliance monitoring. Backing up government data can also be helpful. Before being indicted four times (so far), Donald Trump was the 45th president of the United States. During his administration, there were several instances where government data was removed from government websites or altered. Some examples of altered or removed data include climate change and environmental data, healthcare enrollment information, animal welfare records, and LGBTQ+ rights and resources. We will provide a brief introduction to three different approaches to website scraping. The simplest involves sending requests and using a library like Beautiful Soup to parse the results. This doesn't always work, though, since some sites use client-side Javascript to interact with the server. There are a couple of ways to deal with this. Browsers can be automated with tools like Selenium, and the results can then be parsed with a Python library. However, the results may not be easy to parse, and the final approach presented will show how to intercept and emulate XHR requests. This can potentially yield more data than the page displays. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/7FMB8N/ Workshops & Speed Wendy Edwards PUBLISH UHGLNE@@cfp.hackfest.ca -UHGLNE Stable Diffusion Workshop en en 20231014T103000 20231014T123000 020000

Stable Diffusion Workshop

This workshop uncovers some details about machine learning and models that leads the participants to form a proper yet simple technical understanding of how image related "AI" works. Outline: - Intro (15mins) What is Stable Diffusion What is a Model and Prompt Engineering - Workshop Part 1 (45mins) Model RCE Doable with a laptop and Python This will be classic Python Pickling, requires some programming skills Solution given after 30mins - Break (15mins) Will also be used to catch up with some participants - Workshop Part 2 (45mins) Doable with cellphone or laptop Web browser This will be finding what’s hiding in the deep learning brain This is bleeding edge prompt hacking and is surprisingly accessible by everyone Solution given after 30mins - Bonus: Hypernetworks If time permits, we can look deeper at Hypernetworks and how they are being trained. This is related to the challenges above as the base of it, but also opens the topic to ethical and privacy concerns. PUBLIC CONFIRMED Workshop - 120 minutes https://cfp.hackfest.ca/hf2023/talk/UHGLNE/ Workshops & Speed Jonathan Marcil PUBLISH QC9U39@@cfp.hackfest.ca -QC9U39 A Primer on Wipers en en 20231014T133000 20231014T135000 002000

A Primer on Wipers

There's several topics we'll cover: In the first section, we'll talk about what wipers are and how they are defined in academic literature as well as security news reporting. We'll establish what the general motive of a wiper attack is, what threat actors tend to use wipers, and what the typical patterns are in terms of tactics and techniques. In the second section, we'll discuss the chronological history of wipers and use it to frame how wiper malware has evolved over time. The central focus of this to highlight the commonalities and recurring themes through history even as the technical sophistication can grow. Finally, we'll discuss some of the various types of wiper malware identified in the modern-day, particularly the wiper attacks on Ukraine. Throughout the talk, we'll be citing several different sources from academic and industry research. My hope is that this talk can provide a helpful jumpstart for those who are interested to dive deeper, but the presentation itself should provide a helpful summary of what we know about wipers today. PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/QC9U39/ Workshops & Speed Ali Maredia PUBLISH Z9GXQD@@cfp.hackfest.ca -Z9GXQD Réduire les faux positifs et utiliser les alertes basées sur le risque (Risk-based alerting/RBA) fr fr 20231014T140000 20231014T142000 002000

Réduire les faux positifs et utiliser les alertes basées sur le risque (Risk-based alerting/RBA)

- Introduction (~1min) - Qu'est-ce que la fatigue des alertes et pourquoi il faut en tenir compte? (~2min) - Comment gérer la balance entre le volume d'alertes à traiter et la réduction des faux positifs? (Est-ce dangereux de réduire nos seuils pour recevoir moins d'alertes? Risque-t-on de manquer des alertes importantes?) (~4min) - Pourquoi est-il possible pour une organisation de ne pas détecter certaines activités suspectes malgré la présence de centaines de cas d'usage (Use Case)? (~4min) - Alerte vs. événement notable (~3min) - Attribuer des scores de risque à des objets via les événements notables et générer des alertes selon un seuil prédéfini (Les scores peuvent se multiplier selon les phases de l'attaque (MITRE/Cyber Kill Chain) ou la sévérité des événements, notre imagination est la limite.) (~4min) - Conclusion et questions (~2min) PUBLIC CONFIRMED Speed Talk https://cfp.hackfest.ca/hf2023/talk/Z9GXQD/ Workshops & Speed Jean-Francois Brouillette