When you surf the internet a lot of information is given away by certain properties of communications beyond just the content. These properties are usually referred to as communication metadata. Metadata include information such as the lenght of the conversation, who was involved, where are the parties involved in the conversation located, and so on. These streams of data are collected and stored forever by a hidden network of services that want to know who you are and what you are doing, all the time. "When the past is always with you, it may as well be present; and if it is present, it will be future as well." The Neuromancer Tor is an important tool providing privacy and anonymity online. The property of anonymity itself is more than just providing an encrypted connection between the source and the destination of a given conversation. Encryption only prevents the content of the communication between two parties from becoming known, but there is a lot of information that can still be learned by just observing the traffic. When you use the Tor network, you are not sharing your communication metadata. So that, not only your communication are encrypted, but you can also stay anonymous. Anonymity is a broad concept, and it can mean different things to different groups. This demo is about creating and running ephemeral .onion services to share websites or simple web applications. We present different use cases for onion services and a wrapper app that allows you to start a .onion and start sharing a static website or a web application. Because .onion services live on the Tor network, you do not need hosting or a public ip address to offer some service via .onion address. The .onion is hosted on your computer for the time you desire, allowing the people visiting your site to remain anonymous, and also you. We believe anonymity to be very important since it can free people, allowing them to decide how to expose themselves or to make themselves visible on their own terms.

Charla de concienciación sobre la gran cantidad de datos que estamos generando sin ser conscientes de ellos, de los peligros que comportan para nuestra seguridad y privacidad. Descubriremos como nos vigilan y como se utilizan nuestros datos. Una visión actual y realista del mundo de la ciberseguridad.

Hemos convertido el smartphone en el principal intermediario que nos pone en contacto con el mundo. A medida que la digitalización se expande, la posibilidad de una existencia privada y al margen se hace mas difícil de compaginar. Avasallados como estamos en un entorno cada día mas hostil a nuestra privacidad, queremos transmitir los conocimientos que permitan desarrollar una cultura de la seguridad al alcance de todo el mundo.

When talking about the privacy, there were found some articles about discoveries of privacy violation. Although there were no findings confirming the device were always listening I could find some permissions, when linking to Microsoft calendar, that didn’t correspond to the functionality described. To see which information Alexa generated about me I contact Amazon so I could get it (GDPR). There I confirmed Alexa messages where not encrypted end to end so there where in plain text. Each section will be discussed in the talk showing each step done in the research with a conclusion. Also, how the scheme with BurpSuite was done. The idea is at the end discuss the risks of having these types of devices and what we should do about the privacy aspect specially, if this kind of technology starts to grow.

Hacer un perfil de los solicitantes de empleo en función del contenido de sus buzones de correo electrónico personales en Finlandia; decidir qué pacientes reciben el tratamiento en el sistema de salud pública en Italia; clasificar a los parados en Polonia; identificar automáticamente a los niños vulnerables en Dinamarca; detectar fraude de asistencia social en los Países Bajos o utilizar sistemas de puntuación de crédito forman parte de la gama de aplicaciones de los ADN que se utilizan. Este tipo de algoritmos los encontramos en almenos todos los aspectos de la vida diaria y se continuan ampliando. Muchos de ellos pueden brindar valiosos beneficios a los ciudadanos, pero también presentan riesgos de discriminación injusta, monitorización intrusiva o aumento de la desigualdad. Para los responsables de las decisiones políticas es almenos imposible de hacer un seguimiento de discriminación injusta, monitorización intrusiva o aumento de la desigualdad. Para los responsables de la toma de decisiones políticas es almenos imposible hacer un seguimiento de que sistemas se utilizan, donde y con qué finalidades.

La tesis de Levi és que per molt que intentin convèncer-nos del contrari, les fake news no són un fenomen nou. Els mateixos figures que clamen al cel contra la desinformació són en realitat representants dels gremis i institucions que les han practicat sempre. La solució que proposen? Lleis que retallen dràsticament la llibertat d'expressió i informació. El projecte #FakeYou vol desmuntar els mites en els quals es basa aquesta onada de legislacions lliberticides. Ofereix eines legisaltives per a la defensa de les llibertats fonamentals i contra les noves formes de manipulació, mentida i falsificació.

Threat actors are always looking for ways to hide from AV solutions. Polymorphic or heavily obfuscated malicious executables are quite common. It takes little effort to slightly change the logic of malware in order to prevent detection. Malware can even go fileless. Blocking of domains and IP- addresses of malicious command&control servers is also not always effective, as it is not very difficult for cybercriminals to change the addresses. But changing the protocol of communication between the malware and its C&C is more challenging. There are many examples of various types of malware for different platforms when the executables are constantly changing, but the communication protocol remains the same for months and even years. That's why using network intrusion detection systems which monitor network traffic and scan it with the set of rules can be a good solution in many cases. Another way of using NIDS is threat intelligence or threat classification. Different malware families can use the same packers or obfuscators, and a possible solution for classifying them is checking their communication with C&C (it can be done in the sandbox environment as well). Another problem that can be solved with the help of NIDS is tracing evolution of some malware family. We can look at patterns in communication protocol and say that some malware probably evolved from another.

When talking about lawful or unlawful interception most times It is not a matter of technology or if it goverment sponsored or something homemade when it comes to use the evidence in a trial or courthouse. The problem is the lack of training of all parties involved and the mania of giving everything for good for lack of understanding of the technology that was used to carry on the task, technology taht is not magic but something invented and well documented by humans. In the end it is either security through obscurity or insecurity due to ignorance. This talk will explain the lawful and unlawful interception methods and tecnologies and provide a list of audit tools and guidelines to better understand the: • Legal necessity and proportionality • Provision of reasonable assistance • Existing interception capabilityes • Collateral intrusion

As IoT becomes more integral to our lives, the need to secure them grows. One thing the security industry isn’t talking very often is - IoT security. We talk very often about application security but very rarely we talk about security in Hardware or in particular security in IoT. With application security, you as a penetration tester is confronted with a Windows or a Linux server, or a web application or even a TCP/UDP protocols. But with IoT penetration testing, you have very uncommon architectures like ARM, PowerPC, MIPS, etc. Sometimes, you are even confronted with communication protocols like ZigBee, BLE, NFC, RFID, etc and to make it more complex, many times hardware device manufacturers do have their custom RF frequencies. These require new expertise and several tool sets which are very uncommon. It is no wonder that traditional penetration testers can get completely lost in the world of embedded devices security and their protocols. This talk is going to be a helpful resource to help you become IoT Penetration tester.

While there is already prior research on LoRaWAN security most of them focus on known protocol weakness and theory, none of them provides tools neither examples of common security problems of real deployments. What’s more, currently there are not guidelines neither tools to test the security of LoRaWAN networks, which means that if someone wants to audit a LoRaWan network, she has to start from scratch. Over the last year we have been researching LoRaWAN to identify common security problems and building tools to test LoRaWAN networks security. The main topic in this talk is centered in common security problems we found on LoRaWAN deployments We are going to provide step by step guidelines on how and what to test on LoRaWan networks indicating what hardware and software to use. Plus, we will be releasing new tools to test the security of LoRaWan networks. Finally, we are going to provide recommendations for secure LoRaWan deployments.

Air gap es una medida de seguridad de red empleada en uno o más ordenadores para garantizar que la red informática esté físicamente aislada de internet o de redes no seguras. En esta charla se mostrarán algunas de las investigaciones públicas sobre Air gap malware para que los asistentes puedan entender el concepto. Después, el ponente explicará las tres fases que un atacante tiene que tener en cuenta antes de hacer un Bypass o exfiltración de datos en estos sistemas seguros (infiltración, C&C y exfiltración). Con toda la información mostrada durante la charla, el ponente enseñará desde 0 todo el desarrollo del proyecto en el que está trabajando, un dispositivo capaz de exfiltrar información de estos sistemas mediante varios ataques diferentes (los ataques se mostrarán en profundidad durante la charla). El dispositivo es Open Hardware y el código fuente es completamente público, de esta manera los asistentes podrán montarlo y utilizarlo cuando termine la charla.

Attacks on IVR-systems and Call-centers were discussed at some conferences, those attacks do not change in general: attacker makes a call with spoofed Caller ID (phone number) and performs different actions to bypass authorization. * Banks trying to mitigate those attacks. Different methods will be discussed (some are effective, some are insecure). Also, we will discuss fake protection: situation, when the bank tried to do something, that looks secure, but hackers can still bypass it. * Some banks presented voice recognition systems this year. In general, it looks like advanced IVR-system. I will tell about the main problems and attacks methods. * Attacks on mobile operators: some dangerous problems still exist here (like attack, that allows to spend money from user's account or get private information), but operators try to prevent spoofed calls. I will tell about attacks on different systems and effective methods, which should be considered. New things: * Brute force attacks on IVR systems. Tell in details when it can be effective. Different brute force methods will be considered. * Financial attacks: an attacker can make company spend money for paid actions (like sending SMS) via IVR in some cases. If a criminal can make a company send thousands of SMS, it will cause direct financial harm. * Also, an attacker can enable paid subscriptions via IVR in some cases. It can cause problems and financial harm for the user. * Attacks on Online Shops and Marketplaces * Attacks on Airlines * Attacks on IoT * GSM-alarms And much more....

Qué pasa cuando se intercambian los papeles tecnólogos y juristas: Tres casos de éxito: -El archivo de la causa del 1-0 para los miembros del Partido Pirata -El procedimiento de las válvulas de las Gasolineras -El lobby conjunto (aspertic)

Computer forensics aims to collect digital evidences after a computer incident. These evidences can be collected either from the disk, from the network, or from the memory of the system under analysis. The latter process is termed memory forensics. Memory forensics is useful to detect malware in a computer after an incident occurs. However, the process of memory forensics is not straightforward: malware can use techniques to hide itself and remain undetectable. In this talk, we introduce “malscan”, a Volatility plugin to detect the presence of malware in memory dumps. Compared with other related plugins as “malfind”, our plugin provides better results with less false positive ratio. We will also show our experience developing plugins in Volatility, the de facto tool for memory forensics, by providing tips for plugin development. Finally, we also introduce the current issues and open challenges that we face on memory forensics.

This talk contain a real analysis and live malwares stooled billions of dollars, and this talk focus more on the way to tracking malicious files with describing the sophisticated methods uses by attackers to inject malware and granted access to high authority/system. All the malicious files depends on network to send information of victims and all their data to let the attacker know by all the results come in via Command and Control, to make sure their malware granted access to system they use exploits already published or Zero Day vulnerabilities in this part we will release how malware analyst deal with that’s kind of malwares and define it between the usual bots or sophisticated ones.

In this workshop we will first understand why obfuscation is necessary in mobile apps. We will explore the alternative that we have and justify the election of LLVM as the basis of the project. We will then explain some basic concepts of LLVM, before going on to the “hands on” part of the workshop where we will be implementing a basic compiler/obfuscator during a live coding session.