BalCCon2k24

Opening

Drivers have long been of interest to threat actors, whether they are exploiting vulnerable drivers or creating malicious ones. Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system.

With the existence of malicious drivers, there is a need for those who can analyze identified samples. This analysis requires specific knowledge of the Windows operating system, which can be difficult to acquire. Windows drivers and the kernel can be overwhelming to learn about, as these topics are vast and highly complex. The documentation available on these subjects is daunting and difficult to navigate for newcomers, even for those with programming experience.

This initial hurdle and steep learning curve create a high barrier of entry into the subject. To many, the kernel space seems to be an arcane and hidden part of the operating system.

This presentation will be a high-level introduction into drivers, their usage by malicious actors and the Windows kernel. No previous experience of drivers is required.

Information stealing malware have been quite a menace for some time. In this talk we will briefly go through infostealers, MAAS model and related ecosystem, and focus on the monetisation and abuse of stolen data collected by infostealers. The talk will contain a poor attempt on data analysis.

EMC testing is essential to get a certification of Electromagnetic Emission and Immunity test before launching the product in the market. However, actual EMC tests are pretty expensive. Before going for the actual EMC test, the product should test in EMC pre-compliance test Lab. Pre-compliance testing will mimic all tests performed at EMI/EMC test labs to ensure the device will pass the EMI/EMC compliance test. Compliance test labs are very costly and difficult to pass; the pre-compliance testing cost is cheaper than the actual cost of EMI/EMC compliance test labs and will give approximately the same result.
I will talk about equipment I bought or created to do simple pre-complience testing. Talk will cover testing of different near field probes, creating simple chamber from microwave, doing measurements in basement with TV antenna. I will also show emard idea about creating pyramidal shape chamber that would by the calculations absorb and not reflect most of the signals...

BalCCon2k24 Badge

Observability is a critical aspect of any infrastructure as it enables teams to promptly identify and address issues. Nevertheless, achieving system observability comes with its own set of challenges. It is a time- and resource-intensive process as it necessitates the incorporation of instrumentation into every application.
In this talk, we will delve into the gathering of telemetry data, including metrics, logs, and traces, using eBPF. We will explore tracking various container activities, such as network calls and filesystem operations. Additionally, we will discuss the effective utilization of this telemetry data for troubleshooting.

Traditional AppSec techniques such as testing, scanning, and code reviews are essential but often unable to protect against zero-day vulnerabilities before they are discovered and disclosed. In this talk, we will explore how Runtime Application Self-Protection (RASP) technologies can provide real-time behavioral monitoring and protection for applications during execution. We will dive into the limitations of pre-deployment security and explain why runtime protection is necessary. Furthermore, we will discuss the main components and architecture of a RASP solution, highlighting its key features and benefits. Attendees will gain insights into various RASP techniques, including behavioral analysis, anomaly detection, and machine learning, which are crucial for detecting unknown threats. Real-world examples of RASP preventing zero-day exploits and unknown attacks will be shared, showcasing its effectiveness in safeguarding applications. Lastly, we will provide best practices for implementing and integrating RASP into the CI/CD pipeline and DevOps workflow.

This workshop focuses on how to build a debugger from scratch. It will look at various types of debuggers used for malware analysis followed by an in-depth walkthrough of building a Windows debugger from scratch using Python in JupyterLab.

The persistent surge of AI models is witnessing novel ways of licensing them. This talk explains the recent proliferation of licenses that supposedly call themselves as open but levy additional behavioral restrictions for AI models, based on ethical considerations. This presentation seeks to emphasize how the proliferation of licenses with behavioral restrictions for AI models may impinge on software freedom and cause obstruction to a more distributed control over AI technologies and how openness in AI can be preserved by safeguarding software freedom.

With the growing popularity of gaming and home cinema, fueled by platforms like Twitch and Netflix, private gaming and cinema room setups have become increasingly common among enthusiasts. Govee, with its over 50 products and a distribution network across over 60 countries, has made significant strides in the RGBIC market. In 2020, it reported annual sales of 200 million dollars, highlighting its status as a global player in smart home devices and innovative LED lighting solutions. The focus of this research is one of Govee's flagship products, the H6054, which utilizes an LED setup behind the display and a camera to capture screen colors, creating an immersive experience, similar to Philips' Ambilight feature. The H6054 offers multiple attack surfaces including HTTPS and MQTTS APIs, two circuit boards, Android/iOS applications, firmware/update susceptibilities, and Bluetooth. This research was initially aimed at understanding Internet of Things (IoT) vulnerabilities through the lens of attacking a single device. However, due to the centralization of all owned devices in one account, unauthorized access was gained to all Govee devices. In total eight distinct vulnerabilities were discovered, ultimately granting access to over 12 million living and gaming rooms. This presentation will detail the journey of this research, highlighting the identified vulnerabilities and their broader implications for IoT security in smart home environments.

Every day hundreds of new data sources on security vulnerabilities (CVEs) appear on the web. These are articles, vulnerability databases, code repositories, forums, chats, and they contain a handful of details each. Security operators have to invest a lot of effort to find out:
- Is the published information new or already known?
- What is the applicability? Does the attack target a specific consumer device (e.g. printer), is it about a specific OS (e.g. Windows), is it a local or remote attack?
- What details are provided in the description? Is it a “news-type” article providing essentially a headline, or a “blog-type” article providing technical details that can be used to reconstruct the attack and protect against it?

After sorting out the above questions, provided that we have a new and informative description of the vulnerability, the security operator can finally work on protection measures. In the context of Web Application Firewall (WAF) this means crafting a special rule that will detect and potentially block the malicious traffic without affecting the benign one.

In this talk we present a machine learning pipeline that uses state-of-the-art Large Language Models (LLMs) to automate above tasks. This enables to:
- Reduce time-to-mitigation
- Reduce human costs by saving time required from highly skilled individuals

Our pipeline consists of several building blocks:
- Text extraction (including image-to-text and video-to-text capabilities)
- Classification tasks:
-- Is the article informative?
-- Does the article describe a web attack?
- Generation tasks: given a detailed description of an attack, transform it into a WAF rule that pertains to a given syntax

In this talk we describe the challenges of this exciting problem and show a stack of solutions that can be applied to a wide range of products on the market.

In recent years, a trend towards re-implementations existing or new implementations of Linux command line tools in Rust was identified in the community. Alongside Go and bash, Rust is the leading language for these newly written toools. Let's take a look at the best, practical and entertaining Linux command line tools that meet these criteria.

Dive into the trenches of darknet monitoring with a no-nonsense, technically-focused exploration of data leak analysis on a shoestring budget. This keynote will dissect our journey through the murky waters of the dark web, highlighting the triumphs and pitfalls of using open-source tools and custom scripts to efficiently process massive data leaks. We'll cut through the hype, sharing real-world experiences with automation and machine learning techniques that actually work and those that don't.

See: https://en.wikipedia.org/wiki/PowerPoint_karaoke
Come and participate! Win eternal glory!

In the proposed talk, speakers will comprehensively analyze the relevant operations of the APT group MuddyWater, which emerged on the cybersecurity scene in 2017. This group, with an initial focus on government targets in Iraq and Saudi Arabia, has extended its operations to other countries in the Middle East, as well as Europe and the United States. Throughout 2018, a significant increase in spear phishing documents targeting government, military, telecommunications, and educational entities has been identified in Jordan, Turkey, Azerbaijan, and Pakistan. Victims have also been detected in Mali, Austria, Russia, Iran, and Bahrain, highlighting the attack on the National Cyber Security Center of Saudi Arabia in 2017 to steal credentials and data.

The authorship of MuddyWater's operations remains unknown, although its attacks appear to be geopolitically motivated, targeting high-profile personnel and organizations. The code used in their latest attacks includes features that appear designed to distract and disorient researchers, such as the use of Chinese characters and names such as Leo, PooPak, Vendetta, and Turk in the malware.

MuddyWater is responsible for many attacks and constantly develops new methods and techniques to improve them. This includes active developers improving their toolset to minimize exposure to security products and services. The recent attacks indicate a growing interest in Africa, although its main targets remain Iraq and Saudi Arabia.

In the presentation, the operations carried out by MuddyWater in 2022 and 2023 will be analyzed from the perspective of two different disciplines, offensive security and intelligence analysis, highlighting and analyzing the private tools used as the group like NIHAY, a C#-based tool to download and run; LISFONSERVICE, a C#-based RAT; POWERSTATS, a first stage backdoor based on Powershell among others. In addition to private tools, the group uses tooling also used by network teaming teams such as Koadic C3 COM Command & Control, Meterpreter, Mimikatz, scripts based on Powershell, LAZAGNE, Slaver.py, Cr.exe and Mmap.py (called "MapTools " by MuddyWaters).

Through this talk, speakers will provide a comprehensive view of MuddyWater's techniques, strategies and objectives, highlighting the perspective of offensive security and intelligence. The goal is to provide a deep understanding of how these APT groups operate and how a combined approach can be used to understand the TTPs of this group.

Clue: This glorious competition pits the sharpest minds and greatest nerds of this illustrous community (or, whoever want's to participate really...) against each other in a battle of wits. Contestants show their prowess and speed in hitting buzzers as well as their knowledge about modern, ancient and archaic topics ranging from security to pop culture, while the audience revels in the geeky glory.

Answer: What is Hacker Jeopardy?

This time, with a magnitude more titles available.
New search and submit system that will delight you. We literally rewrote it in Rust!

This presentation will detail the journey of developing an in-house Software Composition Analysis tool, from its inception as a challenge to its realization as a comprehensive, open-source solution. It will cover the motivations, challenges, and unique features of the tool, including dependency checks, custom dashboards, and automatic updates.

All I needed was to move one motor, but I ended with completely reversing all resin printer peripherals. I will talk about challenges and tools I have used, with few nice tricks I figured out in the process.

The emerging cyber threats to the connected vehicles necessitated the hardening of the automotive products. This is not a one-time activity though. Manufacturers (OEMs and Tier1s as well) need to continuously monitor their fleet for threats during the operations period. An appropriate asset management procedure and toolchain is a key success factor for this activity. A manufacturer unaware of the exact – and preferably, real-time – configuration of its vehicles on the road could be unable to tell if the vehicles are affected to a certain vulnerability or not. The concept of digital twins provide means to solve this, creating a visibility of the fleet in the Vehicle Security Operations Center (VSOC). This presentation aims to introduce the current state of automotive cybersecurity to the audience, presents the concepts of digital twins in general, and connects the dots of the automotive fleet management using the digital twins as the main guideance.

The application of Natural Language Processing (NLP) has become increasingly vital for cybersecurity threat intelligence and response strategies today. NLP plays a crucial role by enabling more accurate and nuanced analyses of potential threats through advanced linguistic techniques. Among other applications, NLP allows quicker categorization of threats based on their nature – such as phishing schemes or anomalous behaviors – and enables prioritizing responses accordingly. NLP can also facilitate the development of content prediction schemes for analysts or provide powerful information extraction tools. We will cover two text-mining techniques that we believe are a good starting point with NLP for analysts and incident responders: sentiment analysis and Named Entity Recognition (NER). While sentiment analysis reveals underlying emotions or biases in social media content potentially linked to malicious activities, NER identifies critical information such as IP addresses, domains, and user details essential for correlating incidents across different data sources.

The workshop is fully hands-on, with a maximum of exercises and tests. You will be provided with a full development environment that contains everything necessary for the workshop, including all deep learning and NLP tools. You will build step-by-step two NLP pipelines to practice these techniques with real data. After the workshop, you can expect to have a good understanding of NLP foundational tasks and be ready to apply your new skills on your own data. Prerequisites: Familiarity with Python programming is expected.

Active Directory Federation Services (AD FS) is a Microsoft technology providing Active Directory users with federated SSO access to applications located within and across organisational boundaries, and to cloud applications. AD FS is an attractive target for threat actors, as it holds the keys to impersonating any user on any federated service.

Due to the high impact of a compromise, AD FS servers are often protected to the same degree as Domain Controllers and other "Tier 0" services. The configuration database used by the AD FS service is often located on a SQL Server cluster along with the databases of other, lower tier, services, however. This configuration exposes AD FS to attacks from users with Database Administrator (dba) privileges or threat actors who have compromised the SQL Server host some other way.

While previous attacks against AD FS federated logins (e.g. the MagicWeb malware[1]) have required compromising the AD FS server, this session will present a novel technique resulting in impersonation of any identity through modifying the contents of the configuration database without any requirements on privileged access to the AD FS server. It will provide offensively-minded attendees with another technique with which to target Active Directory-based estates. Blue teamers in attendance will walk away with an understanding of the artefacts and detection opportunities associated with this new attack vector.

[1] https://www.microsoft.com/en-us/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/

How fast (or slow) can you type? Why not come and show us. During this workshop find out how you compare to others. Bring your own keyboard or try your luck with one of our own. Earn the bragging rights as the fastest typer and even some prizes(?)

Lockpicking is great. But when you don't have the time to kneel in front of a keyhole and pick it, you need something faster. What can be done?

Threat Modeling is like playing detective in cybersecurity. It’s about understanding what cyber baddies might want from your project and how they could try to get it. While some say it’s a marathon, I say keep it simple with K.I.S.S. (Keep It Simple, Silly). This approach makes cybersecurity accessible and effective without the headaches.

This talk also explores the quirks of Threat Modeling for AI and LLMs because even tech wizards need a good security spell. This talk isn’t just theory — it’s about teamwork from the get-go. By uniting developers and security pros early on, you can slash the time it takes to squash cyber threats.

You're reading or writing text on a computer? Then you're dealing with fonts and typography. We'll have a look at what different font formats are capable of and how font rendering works. Join us on this trip from American Typewriter to Zapf Dingbats.

Search engine advertising, a service designed to help businesses reach a wide audience, has been increasingly targeted for malicious purposes. Over a three-month period, I created a website that converts different file formats and advertised it using Google Ads. Users were informed in the Terms of Service about the data collection practices. This presentation will detail how advertising services can be misused by malicious actors to obtain private and classified documents. The entire process behind this study and the results of the advertising campaign will be explained.

In recent developments, advancements have emerged in the realm of safeguarding against memory corruption bugs, incorporating stack-based protections at both the hardware and software levels. Notably, Linux has recently implemented additional protective measures on the Intel platform, specifically through the introduction of a shadow stack. Therefore, it is a great time to delve into this topic.

Discover my journey as I decided to reliably earn money by gambling in online casinos!
With some very little crypto-coins that I did not own beforehand,
let's analyze how I found some vulnerabilities then exploited some JS hacks, cryptography, or even probabilities to my advantage.

Now let's remember that the house always wins, and otherwise it will ban you...
So quit before it's too late!

This beginner's workshop introduces students to the basics of malware analysis. This includes how to source new malware samples for practice as well as where to find resources for self-directed learning. Students will learn how triage malicious email attachments as well as how to work with automated malware analysis tools. As a capstone exercise, students will learn the basics of manual code reversing using a disassembler and interactive behavioral analysis using a debugger in a controlled lab environment.

Here author presents a novel method to estimate the type of traffic (file downloads, streaming, VoIP, etc.) going through a router via a probe initiated from a different network.

Regular people try to compete to see who can pick a padlock or a lock faster.

Curious about the art, science and technique of homemade fireworks?
This presentation will start you from scratch and put you on the path
to better living through energetic chemistry. Learn how to start with
simple materials and tools obtainable by the resourceful hacker and
end up with spectacular devices such as aerial shells, rockets, ground
effects and more. No chemistry background needed. Legal aspects will
not be covered, it will be left up to you to research compliance with
any local regulations!

OT and scada environments are becoming more exposed to standard it threats. What we can do to understand possible attack vectors and how to prevent them?

Non recorded session!

Rakija connecting people!

Rakia is one of the most popular alcoholic drink in Serbia. It is usually served before lunch and dinner and is drunk along with appetizers. It is mandatory to drink with roasted pig, lamb, or dried meat. It is a very important part of the Albanian and Serbian cultures and there are many historians that say that the origins of rakia are in Serbia. Serbia has the most consumption of rakia per capita and is the largest exporter of rakia. In a 2009 European Court ruling, the names "Slivovica" (Slivovitz), Dunjevaca, Orahovaca, and Kruskovaca were ruled to be Serbian and thus the country has a trademark on those three types of rakia (Slivovitz being the most famous and most consumed in the world).

Rakia is part of Serbian culture. It is part of many special occasions, including baptisms, marriages, joining of the army, and visiting of friends. At funerals, custom demands that a bottle of rakia be left on the grave of the deceased who liked to drink it, or at least to sprinkle a drop or two during the memorial service for peace of the person’s soul. For some peasants, a flask of rakia is one’s only luggage. Poor peasants many even offer the village doctor, policeman, judge, tax collector, or minister a flask of rakia as a gift of payment. Many folk songs have been composed during rakia production.
Rakia is one of the most popular alcoholic drink in Serbia. It is usually served before lunch and dinner and is drunk along with appetizers. It is mandatory to drink with roasted pig, lamb, or dried meat. It is a very important part of the Albanian and Serbian cultures and there are many historians that say that the origins of rakia are in Serbia. Serbia has the most consumption of rakia per capita and is the largest exporter of rakia. In a 2009 European Court ruling, the names "Slivovica" (Slivovitz), Dunjevaca, Orahovaca, and Kruskovaca were ruled to be Serbian and thus the country has a trademark on those three types of rakia (Slivovitz being the most famous and most consumed in the world).

Rakia is part of Serbian culture. It is part of many special occasions, including baptisms, marriages, joining of the army, and visiting of friends. At funerals, custom demands that a bottle of rakia be left on the grave of the deceased who liked to drink it, or at least to sprinkle a drop or two during the memorial service for peace of the person’s soul. For some peasants, a flask of rakia is one’s only luggage. Poor peasants many even offer the village doctor, policeman, judge, tax collector, or minister a flask of rakia as a gift of payment. Many folk songs have been composed during rakia production.

AttackMate is a modern open-source tool for automating cyberattacks. It supports scripting attack techniques across all kill chain phases and focuses on real-world attacks rather than purely simulated adversary behavior. AttackMate executes well-known exploits and publicly available malware and allows, therefore, variations of different attack techniques. One of AttackMate's significant advantages is that it combines several attack techniques into complex attack chains that reflect the behavior of advanced attackers. This talk explains the motivation behind the development of the AttackMate and illustrates possible use cases. It presents the essential concepts of the AttackMate framework and depicts how it extends the state of the art beyond existing tools. This presentation will provide an overview of the most valuable features of Attackmate. Eventually, the talk demonstrates how the AttackMate automatically exploits a target and gains root access.

The application of Natural Language Processing (NLP) has become increasingly vital for cybersecurity threat intelligence and response strategies today. NLP plays a crucial role by enabling more accurate and nuanced analyses of potential threats through advanced linguistic techniques. Among other applications, NLP allows quicker categorization of threats based on their nature – such as phishing schemes or anomalous behaviors – and enables prioritizing responses accordingly. NLP can also facilitate the development of content prediction schemes for analysts or provide powerful information extraction tools. We will cover two text-mining techniques that we believe are a good starting point with NLP for analysts and incident responders: sentiment analysis and Named Entity Recognition (NER). While sentiment analysis reveals underlying emotions or biases in social media content potentially linked to malicious activities, NER identifies critical information such as IP addresses, domains, and user details essential for correlating incidents across different data sources.

The workshop provides a hands-on, iterative deep dive into transformer-based NLP techniques and their applications in text mining and generation for cybersecurity threat intelligence and response strategies. It is dedicated to people who have already an experience using natural language processing and LLM or LLM with front-end (ex:LM studio), or deep learning to deeper their understanding and skills.

Doing with free open-source software what could cost a lot, and benchmarking solutions to find the best fit.

While the reverse engineering suite Ghidra is typically extended through its Java and Python APIs, these APIs hide many of the lower level details available in the decompiler component. Using this API makes it possible to access decompiler internals and integrate the decompiler into other tools (e.g. the Radare2/Rizin plugin). This talk gives an overview of the decompiler architecture and presents the tools we are building to make the decompiler more extensible.

The glibc allocator is a complex system, an algorithm with many datastructures, leaving it with a large attack surface and many fun ways to go about exploiting it. In this talk we will go over what it is and how it works, touching on the concepts and ideas that its original designers considered. We will talk about how to approach heap exploitation in general, and learn through example by going through a straight-forward CTF challenge.

Although the last part of the talk will be more technical, anyone who is interested in how memory allocation works is welcome with no prerequisites.

I'm going to talk about theory for solutions of quest steps and using well-known & new tools for RFID pentest

There's some intro with basics & theory

After that we disclosure how is possible to pass the quest

And which tools are helpful in this kind of security

JellyfishOPP is (will be) an open-hardware measurement device and programmable power supply designed to provide advanced, bidirectional power measurements, power optimizations, and battery profiling/simulation. It primarily targets developers of ultra-low power devices such as IoT sensors and wearable electronics, while also serving engineers, hardware hackers and hobbyists. It is a portable USB device that can be controlled through a host computer or smartphone app. Additionally, it features a simple on-device user interface for basic functionalities, eliminating the need for a host device in certain scenarios.

This talk will cover the design decisions and the current development status of the device. The main web page containing the info and links to all of the development updates can be found at https://hyperglitch.com/jellyfish.

No prior knowledge is needed to follow the talk, although some basic familiarity with electronics can help.

In the last decade or so many people started projects aimed to make development of games and demos for retro computers more accessible and to bring them to modern standards (whatever that means). Turbo Rascal Syntax Error (TRSE in short) is one such tool.

Talk aims to present TRSE as a retro-computing oriented IDE, then to showcase some of the games and demos made with it and at the end to introduce the audience to a simple demonstration that could be changed, expanded and run on real computers in Retro Room (or in your favorite emulator, if you prefer).

In this talk, we'll review some of the wireless protocols and signals produced
and consumed by our modern tech devices and infrastructure around us.
Furthermore, we'll explore the privacy and security implications of some of
these protocols.

No prior knowledge about wireless protocols or signal analysis is required. We'll explore signals live both with an SDR (Software Defined Radio) as well as cheap consumer devices.

Closing ceremony

After Party