2.0 -//Pentabarf//Schedule//EN PUBLISH LB9CZS@@cfp.pass-the-salt.org -LB9CZS Welcome en en 20210705T134500 20210705T140000 0.01500 Welcome PUBLIC CONFIRMED Special https://cfp.pass-the-salt.org/pts2021/talk/LB9CZS/ Zoom room PUBLISH LQDHNS@@cfp.pass-the-salt.org -LQDHNS Jailbreak detection mechanisms and how to bypass them en en 20210705T140000 20210705T143500 0.03500 Jailbreak detection mechanisms and how to bypass them PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/LQDHNS/ Zoom room Eloi Benoist-Vanderbeken PUBLISH MGCYPT@@cfp.pass-the-salt.org -MGCYPT Pithus: let's open the Android pandora's box en en 20210705T144000 20210705T151500 0.03500 Pithus: let's open the Android pandora's box PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/MGCYPT/ Zoom room U039b PUBLISH CTWBB8@@cfp.pass-the-salt.org -CTWBB8 Hook as you want it en en 20210705T152000 20210705T155500 0.03500 Hook as you want it PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/CTWBB8/ Zoom room Benoit Forgette PUBLISH LA9V9Y@@cfp.pass-the-salt.org -LA9V9Y PatrowlHears and Survival tips for prioritizing threats en en 20210705T161000 20210705T164500 0.03500 PatrowlHears and Survival tips for prioritizing threats Solutions must be found to face the overall growing threat of attacks, talent shortage and cost optimization challenges in cybersecurity. The current trend is to rely on automation and orchestration of security operations. The fact is automating SecOps activities leads to manage more security alerts. The downside is that potentially a bunch of new security alerts every day. By the way, with hundreds of vulnerabilities with critical or high severity to deal with, the daily security reports look like a shining Christmas tree. It could definitely lead to jaded teams or, even worse, bad decisions in vulnerability handling. Obviously, it is not realistic to hope that all vulnerabilities will be fixed. A line have to be drawn by the business owners according with the security teams. Prioritization is an essential success factor for improving efficiency and continue to provide the highest quality and relevant service in security incident response and vulnerability management. Because the CVSS score is not enough, which are the relevant metrics ? How to collect them ? Which decision should be made ? How to review efficiency of this process and adapt it ? This talk is about to share insights on a risk-based methodology in vulnerability management and a new open-source tool PatrowlHears. This approach is enabled by a balanced usage of SecOps automation to keep us updated for vulnerabilities, exploits and other threat information, and prioritization using vulnerability metrics, threat topicality and asset criticality. Also, it will be discussed on examples of events that should conduct us to consider reprioritization of a vulnerability handling. PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/LA9V9Y/ Zoom room Nicolas Mattiocco PUBLISH JDP7LB@@cfp.pass-the-salt.org -JDP7LB Forensics Low Level - Having fun with Linux onboard tools en en 20210705T165000 20210705T172500 0.03500 Forensics Low Level - Having fun with Linux onboard tools The presentation will consists out of 3 live demos. All the demos based on Linux standard tools like 'dd', 'hexedit' and alike. 1. In Forensics a HW write-blocker is necessary. Just mounting the device in RO mode is not sufficient. I will connect a USB stick to my laptop and mount it RO. After this I will modify some data on the USB stick. 2. I have a standard USB stick and simply modify some (3) bytes on it. The result, Linux will mount up to 250 partitions. Some tools either hang or simply display wrong information. You need to read the bytes of the partition table to understand whats going wrong. 3. If you connect another USB stick to a Windows, file A, B and C have content X, Y and Z. If you connect the same USB stick to Linux, file A, B and C have content U, V, W. Analyzing and understanding the Master Boot Record will reveal the secret. PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/JDP7LB/ Zoom room Michael Hamm PUBLISH PGEJ7T@@cfp.pass-the-salt.org -PGEJ7T Fedora CoreOS, a container focused OS to securely deploy and run applications en en 20210706T140000 20210706T143500 0.03500 Fedora CoreOS, a container focused OS to securely deploy and run applications PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/PGEJ7T/ Zoom room Timothée Ravier PUBLISH YPKX9Q@@cfp.pass-the-salt.org -YPKX9Q Hosting Identity in the Cloud with free softwares en en 20210706T144000 20210706T151500 0.03500 Hosting Identity in the Cloud with free softwares I will talk here about a new initiative, which relies on FusionIAM project, that gathers well known IAM free softwares like OpenLDAP, LemonLDAP::NG, LDAP Tool Box and Fusion Directory. We will see how deploy and use these components in the Cloud to offer an alternative to proprietary solutions. PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/YPKX9Q/ Zoom room Clément Oudot PUBLISH DASVEW@@cfp.pass-the-salt.org -DASVEW Biscuit: pubkey signed token with offline attenuation and Datalog authz policies en en 20210706T152000 20210706T155500 0.03500 Biscuit: pubkey signed token with offline attenuation and Datalog authz policies PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/DASVEW/ Zoom room Geoffroy Couprie PUBLISH UCN3C9@@cfp.pass-the-salt.org -UCN3C9 Generating Weird Files en en 20210706T161000 20210706T164500 0.03500 Generating Weird Files PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/UCN3C9/ Zoom room Ange Albertini PUBLISH GGLJSS@@cfp.pass-the-salt.org -GGLJSS Home-Made Distributed Blocklist en en 20210706T165000 20210706T172500 0.03500 Home-Made Distributed Blocklist PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/GGLJSS/ Zoom room Xavier Mertens PUBLISH TMB7XQ@@cfp.pass-the-salt.org -TMB7XQ Security alerting made easy using Python en en 20210706T173000 20210706T175000 0.02000 Security alerting made easy using Python PUBLIC CONFIRMED Short Talk https://cfp.pass-the-salt.org/pts2021/talk/TMB7XQ/ Zoom room Peter Czanik, syslog-ng PO at One Identity PUBLISH MZRXDW@@cfp.pass-the-salt.org -MZRXDW ATT&CKing Kubernetes: A technical deep dive into the new ATT&CK for Containers en en 20210707T140000 20210707T143500 0.03500 ATT&CKing Kubernetes: A technical deep dive into the new ATT&CK for Containers ​Introduction to Kubernetes Outline of K8s Architecture​ Control Plane Kube API Server Kube Controller Manager etcd Kube Scheduler Cloud Controller Manager Worker Nodes kubelet kube-proxy CRE (Container Runtime Engine) MITRE ATT&CK ​ - K8s Threat Matrix ​ - MITRE ATT&CK for Containers ​(and K8s) - K8s ATT&CK Scenario & Flow​ Attacking K8s​ - Recon / Initial Access​ - Exploitation / Execution - Post-Exploitation / Persistence​ Defending K8s​ - API Server​ - CIS Benchmark​ - Image Scanning​ - Runtime Protection​ - Network Policy​ - Pod Security Policy (PSP)​ - Deprecated - PSP Alternatives​ - Audit Logs PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/MZRXDW/ Zoom room Magno Logan PUBLISH N3EUGV@@cfp.pass-the-salt.org -N3EUGV Revisiting the Art of Encoder-Fu for novel shellcode obfuscation techniques en en 20210707T144000 20210707T151500 0.03500 Revisiting the Art of Encoder-Fu for novel shellcode obfuscation techniques Idea is to develop an understanding of obscure assembly instructions and to be able to associate with the common trends in place in automative tools. The talk focuses on building the ability to see current patterns, trends in evasion, and detection methodologies that also include advanced "one-way" shellcode and multi-stage payloads that can evade defenses. The talk also includes a deep dive into the idea of obfuscation of shellcodes and executables as deliverables/payloads and focusing on techniques categorically - Basic encoding, Morphing/partial-morphing, Cross-compilation, Polymorphism vs Encrypted and Mutated encoders At the end of the talk, we will also cover the analysis of publicly available encoders from MSF that are used in common offensive tradecrafts shows how the fundamentals mentioned above make them relevant in modern attack scenarios. PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/N3EUGV/ Zoom room Harpreet Singh Yashdeep Saini PUBLISH DPKWYA@@cfp.pass-the-salt.org -DPKWYA In Search of Lost Time: A Review of JavaScript Timers in Browsers en en 20210707T152000 20210707T155500 0.03500 In Search of Lost Time: A Review of JavaScript Timers in Browsers This research was done in collaboration with Clémentine Maurice and Pierre Laperdrix, and was published at the EuroS&P 2021 conference. Paper: https://people.irisa.fr/Thomas.Rokicki/publications/timer-paper.pdf Repository: https://github.com/thomasrokicki/in-search-of-lost-time Variations of computation time can reveal information about the state of a system. Research has uncovered a variety of side and covert channels, allowing potential attackers to extract secrets or track user behavior. Timing attacks can aim at different components of the microarchitecture, e.g., cache, DRAM, and are purely software-based. These attacks have two common prerequisites: they run code on the victim's hardware, and they rely on high-resolution timers that can distinguish small timing variations in the order of 100ns. Most of the timing attacks are implemented in native code, allowing the attacker to have great control over the memory and cycle-accurate timers. In contrast, JavaScript is a high-level object-oriented interpreted scripting language, following the ECMAscript standard. Contrary to native code, it is much easier to run JavaScript code on a victim's system as it is a major component of the web, used by billions of people everyday. Almost all websites use JavaScript to execute code on the client side and by visiting a page, a client can download and execute dozens of different scripts. For security purposes, JavaScript code runs inside a sandboxed environment, restricting access to local files, virtual or physical memory addresses and native instructions. These restrictions make it harder to implement microarchitectural attacks. However, fully JavaScript-based timings attacks, running entirely in the browser, were implemented, bypassing the sandbox restrictions. These attacks include cache attacks, attacks on shared software resources, and even transient execution attacks like Spectre. To try and mitigate JavaScript-based timing attacks, browser vendors have developed countermeasures, specifically targeting timers. Notably, they decreased the resolution of timers to make them less precise and introduced jitter to add noise in measurements. Other security features like site isolation were added to reinforce the security of browsers and act as a novel line of defense against timing attacks. After the publication of such countermeasures, browser vendors reallowed access to high resolution timers. Amid all these changes, it can be hard to keep track of all the different evolutions that browsers underwent. Particularly, it is unclear how the attacks described in the literature are impacted by current countermeasures. In this presentation, we will introduce the various ways to create high resolution timers in JavaScript. Then, we will present the major classes of browser-based timing attacks, followed by the browser-based countermeasures. Finally, we will evaluate the efficiency of the evolution of countermeasures in the later releases of Firefox and Chrome. PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/DPKWYA/ Zoom room Thomas Rokicki PUBLISH NQDAJF@@cfp.pass-the-salt.org -NQDAJF ORAMFS: Achieving Storage-Agnostic Privacy en en 20210707T161000 20210707T164500 0.03500 ORAMFS: Achieving Storage-Agnostic Privacy PUBLIC CONFIRMED Talk https://cfp.pass-the-salt.org/pts2021/talk/NQDAJF/ Zoom room Nils Amiet Tommaso Gagliardoni (Tech Lead Cryptography, Kudelski Security) PUBLISH 8CAB8G@@cfp.pass-the-salt.org -8CAB8G Meet Piotr, a firmware emulation tool for trainers and researchers en en 20210707T165000 20210707T171000 0.02000 Meet Piotr, a firmware emulation tool for trainers and researchers PUBLIC CONFIRMED Short Talk https://cfp.pass-the-salt.org/pts2021/talk/8CAB8G/ Zoom room Damien Cauquil (R&D Engineer at Quarkslab)