BEGIN:VCALENDAR VERSION:2.0 PRODID:-//pretalx//cfp.pass-the-salt.org//pts2023 BEGIN:VTIMEZONE TZID:CET BEGIN:STANDARD DTSTART:20001029T040000 RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 TZNAME:CET TZOFFSETFROM:+0200 TZOFFSETTO:+0100 END:STANDARD BEGIN:DAYLIGHT DTSTART:20000326T030000 RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3 TZNAME:CEST TZOFFSETFROM:+0100 TZOFFSETTO:+0200 END:DAYLIGHT END:VTIMEZONE BEGIN:VEVENT UID:pretalx-pts2023-VRBZJZ@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T141500 DTEND;TZID=CET:20230703T171500 DESCRIPTION:Sanzu is a graphical remote desktop solution. It is fast\, robu st\, and of course Open Source ! DTSTAMP:20260910T045848Z LOCATION:Workshop room SUMMARY:Sanzu Hands-on - Antonin Fringant\, Frédéric Vannière URL:https://cfp.pass-the-salt.org/pts2023/talk/VRBZJZ/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-9ZDVHG@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T141500 DTEND;TZID=CET:20230703T145000 DESCRIPTION:Trusted Platform Module (TPM) is a standard for a secure crypto processor. TPMs come in different flavors: there are discrete chips\, inte grated TPMs\, firmware-based TPMs\, and virtual TPMs. They provide a numbe r of cryptographic features\, such as generation and secure storage of cry ptographic keys\, symmetric and asymmetric encryption/decryption\, digital signature generation/verification\, and random number generation. Typical use cases include attestation of the boot process integrity\, storage of disk encryption keys\, and digital rights management.\n\nThe Trusted Compu ting Group (TCG)\, a nonprofit organization\, is in charge of publishing a nd maintaining the TPM standard. As such\, they provide a reference implem entation of the TPM 2.0 specification. While auditing this reference imple mentation code\, we discovered two vulnerabilities in the handling of encr ypted parameters: an out-of-bounds write and an out-of-bounds read\, which were assigned CVE-2023-1017 and CVE-2023-1018\, respectively. Given that the bugs originate from the reference implementation\, these two vulnerabi lities propagated across multiple code bases and ended up affecting a wide range of vendors\, from chip manufacturers to virtualization solutions an d cloud computing providers. Among the impacted source trees we can mentio n the open source implementations of the TPM 2.0 standard published by Mic rosoft and IBM\, as well as libtpms\, an open source library providing sof tware emulation of a Trusted Platform Module\, which in turn is used by ot her free software projects\, such as QEMU and VirtualBox\, to provide a vi rtual TPM device for VMs.\n\nWe'll start this presentation by discussing h ow TPMs work\, implementation details of the different virtual TPMs\, and the internals of the protocol used to send TPM 2.0 commands. Then we'll go over the specifics of the two vulnerabilities we discovered\, addressing the affected products as well as the possibilities for exploitation. Final ly\, we'll conclude the talk with some highlights of the complex\, industr y-wide disclosure process we conducted\, in which numerous parties were in volved. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Vulnerabilities in the TPM 2.0 reference implementation code - Fran cisco Falcon URL:https://cfp.pass-the-salt.org/pts2023/talk/9ZDVHG/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-QQR3PB@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T145000 DTEND;TZID=CET:20230703T152500 DESCRIPTION:During the boot of a PC\, it is now common to have each stage i nvolved in the booting process to store measurements of the next component to be loaded into a Trusted Platform Module (**_TPM_**)\, in order to kee p a tamper-proof log of the boot chain.\nThose measurements are then lever aged to seal secrets\, _e.g._ a disk encryption key\, or to report the sta te of the device to a remote server in a cryptographically secure way\, us ing a procedure known as **_remote attestation_**.\n\n_Remote attestation_ has slowly gained traction over the last few years\, most notably among c loud providers such as Azure\, to guard access to online resources.\nIt is also a key element in validating _Dynamic Root-of-Trust Measurements_ (DR TM)\, which reduce the Trusted Computing Base (TCB) compared to traditiona l UEFI-based boot chains\,\nbut require a trusted third-party to validate the final state of the system.\nUnfortunately\, little progress has been m ade recently to enable individual users without access to server resources to reap the benefits of remote attestation.\nThis is particularly frustra ting considering that almost everybody carries a small trusted server with them all the time: smartphones.\n\nBuilding upon an idea by Matthew Garre tt[^1]\, we introduce [Ultrablue](https://github.com/ANSSI-FR/ultrablue) ( _**U**ser-friendly **L**ightweight **T**PM **R**emote **A**ttestation over **Blue**tooth_)\, a solution to securely inspect and validate a TPM event log from a phone.\n[Ultrablue](https://github.com/ANSSI-FR/ultrablue) con sists of a command-line attester\, running on a computer\, and an Android graphical application\, running on a trusted phone\, communicating over en crypted Bluetooth low-energy (BLE).\nPairing the phone and computer is mad e easier and more secure through the use of a QR Code.\nAfter a trust-on-f irst-use provisioning phase to enroll the computer on the phone\, the phon e can check that the boot chain has not been compromised in later boots.\n Sample scripts and a self-contained virtual machine are also provided as a reference of how to integrate [Ultrablue](https://github.com/ANSSI-FR/ult rablue) in the boot process to guard disk encryption by a secret delivered by the phone. A practical session will demonstrate this process during th e conference.\n\nFuture work includes improving the user interface to insp ect and validate unexpected event logs\, adding support for more versatile verification policies\,\nand integrating Ultrablue into existing hardened systems such as [Safeboot](https://safeboot.dev/) ([safeboot.dev](https:/ /safeboot.dev/)).\n\nThe [Ultrablue](https://github.com/ANSSI-FR/ultrablu e) project has been developped at [ANSSI](https://www.ssi.gouv.fr) ([ssi. gouv.fr](https://www.ssi.gouv.fr)) by Loïc Buckwell\, under the supervisi on of Nicolas Bouchinet and Gabriel Kerneis.\n\n[^1]: Linux Conference Aus tralia\, 2020. [https://www.youtube.com/watch?v=FobfM9S9xSI](https://www.y outube.com/watch?v=FobfM9S9xSI) DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Ultrablue: User-friendly Lightweight TPM Remote Attestation over Bl uetooth - Nicolas Bouchinet\, Loic Buckwell\, Gabriel Kerneis URL:https://cfp.pass-the-salt.org/pts2023/talk/QQR3PB/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-L38TN3@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T152500 DTEND;TZID=CET:20230703T160000 DESCRIPTION:EDK II is the public implementation of UEFI on which a large pa rt of the OEMs rely to craft their own firmware. If a vulnerability were t o be found in this project\, it could become a huge problem as it could im pact many devices. Or... It could be unimpressive and go totally unnoticed because nobody cares. ¯\\\\\\_(ツ)_/¯ \nIn this talk\, we'll present a bug in EDK II which is difficult to leverage in real life but still quit e fun to attack. \nWe'll see how we can build a complete exploit solely b ased on the mechanisms that are present in the public implementation and h ow we can gain arbitrary code execution in SMM thanks to that. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:For Science! - Using an Unimpressive Bug in EDK II To Do Some Fun E xploitation - Gabrielle Viala URL:https://cfp.pass-the-salt.org/pts2023/talk/L38TN3/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-MPY7WA@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T163000 DTEND;TZID=CET:20230703T170500 DESCRIPTION:The ups and downs of a pentester who decided to daily drive Qub es OS as his working environment. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:The Good\, the Bad\, and the Secure: a pentester's journey daily dr iving Qubes OS - Pierre Milioni URL:https://cfp.pass-the-salt.org/pts2023/talk/MPY7WA/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-USSHMR@cfp.pass-the-salt.org DTSTART;TZID=CET:20230703T170500 DTEND;TZID=CET:20230703T174000 DESCRIPTION:After 13 years\, a new major release of the syslog-ng logging a pplication is available. Previously\, syslog-ng handled all data as text. Syslog-ng 4.0 can associate the proper type information with data parsed f rom log messages. You can use type information for comparisons within sysl og-ng\, and storing data to various destinations\, like Elasticsearch or M ongoDB. Type support enables more precise filtering and thus real-time sec urity alerting in syslog-ng\, and easier searching and reporting in databa ses. I give a quick overview of the major new syslog-ng 4 features and sho w with examples how these improve security at your organization. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Syslog-ng 4.0 – where log management is heading - Peter Czanik\, syslog-ng PO at One Identity URL:https://cfp.pass-the-salt.org/pts2023/talk/USSHMR/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-DTDEC8@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T091500 DTEND;TZID=CET:20230704T095000 DESCRIPTION:Websites are a hellish mess and even when you're lucky enough t o have a still-working URL they will often have widely different outcomes depending on your browser settings\, your location and the instant you try to load it. This talk will show you a few examples and a complete suite o f tools to integrate such an analysis in your day-to-day workflow. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Analyse your weird URLs the easy way - Raphaël Vinot (Developer\, Lookyloo) URL:https://cfp.pass-the-salt.org/pts2023/talk/DTDEC8/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-DEPJLQ@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T091500 DTEND;TZID=CET:20230704T121500 DESCRIPTION:The syslog-ng application is an enhanced logging daemon with a focus on portability and high-performance central log collection. It is us ed mainly by IT security professionals\, but also in Ops and DevOps enviro nments and by embedded developers. The syslog-ng workshop helps you take t he first steps with syslog-ng\, and shows how you can quickly get more inf ormation out of your logs and have greater insight into what happens on yo ur network. Ideal for beginners\, but covers advanced possibilities for se asoned syslog-ng users as well. It also introduces you to syslog-ng 4 chan ges\, focusing on type support\, and how it makes your work easier and bro adens possibilities. DTSTAMP:20260910T045848Z LOCATION:Workshop room SUMMARY:Syslog-ng: from zero to hero\, including syslog-ng 4 changes - Pete r Czanik\, syslog-ng PO at One Identity URL:https://cfp.pass-the-salt.org/pts2023/talk/DEPJLQ/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-C9XNRF@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T095000 DTEND;TZID=CET:20230704T101000 DESCRIPTION:Existing tools like dnstwist or urlcrazy are useful for identif ying typosquatting\, but they don't allow users to choose a generation of variation with all possible algorithms. To address this\, we created a lib rary that compiles all possible variations for a domain name. But why stop there? We also developed a user-friendly website to make the tool accessi ble to everyone. And now\, there's a possibility to look for package squat ting on platform like pypi...\n\nIn this session\, we will introduce the w ebsite and its functionalities\, including all possible algorithms current ly implemented in the library. Our library and website are both open sourc e\, and there is even an online version available to the public\, as well as MISP integration. With these resources\, there is no excuse for not pro tecting your organization from potential typosquatting domains. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Typosquatting-finder - Alexandre Dulaunoy\, David Cruciani URL:https://cfp.pass-the-salt.org/pts2023/talk/C9XNRF/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-YNEF3M@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T101000 DTEND;TZID=CET:20230704T103000 DESCRIPTION:In the last decades\, the world connectivity has increased expo nentially\, and emails is one of the key indicator of this connectivity. I n 2022\, more than 340 billions emails were sent on average each day\, an increase of about 5% in comparison to the preview year. Because the reach of emails is so broad\, they have been in the recent years used more and m ore to perform a wide variety of cyber security attacks. On the one side\, targeted attack such as spear-phishing or Business Email Comprise (BEC) c an be disastrous for companies and are responsible for millions of dollar loss each year. These kind of attacks are usually fine tuned to deceive th e victim\, and thus very hard to detect with automation. Furthemore they a re really sparse in comparison to other types of email attacks (1 in 100 0 00 emails). On the other side\, spam and phishing campaigns are broad atta cks that usually target large group of email address. Campaign attacks are typically composed of bulks of email sharing a similar template and sent en masse in the hope of hitting just a small fraction of their targets\, p rioritizing quantity of attack sent over quality of the attack (about 80% of emails sent every day are spam emails). For cybersecurity providers suc h as Vade\, a challenge is to detect and block these campaigns as fast as possible. While emails in a campaign used to be the exact same and thus re latively easy to catch\, attackers have been more and more keen to add noi se and tricks to fool detection algorithms\, while still maintaining the v isual aspect of the email. This evolution has seen\, as a consequence\, an increase in interest for the nearest neighbor problem. The nearest neighb or problem (nnp) is an optimization problem that arise for many kind of da ta driven tools. In particular\, detecting duplicate or near-duplicate doc ument is a critical application of the nnp. A similarity search problem us ually involves a large collection of object\, each characterized by a set of features and re-presentable as points in high-dimensional attribute spa ce. Given a document\, we are queried to find its most similar documents i n the database. This problem has been shown to be NP-complete\, and as suc h is still unfeasible to solve in reasonable time DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Clustering large amount of email with Minhash: an open-source Local ity sensitive hash - Nicolas Berveglieri URL:https://cfp.pass-the-salt.org/pts2023/talk/YNEF3M/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-8MS9ZL@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T110000 DTEND;TZID=CET:20230704T113500 DESCRIPTION:Data Mining\, Darknet\, and Social Network Monitoring are criti cal components of modern threat intelligence and security operations. The AIL Project is an open source framework designed to collect\, crawl\, dig\ , and analyze unstructured data from various sources. With its extensible Python-based framework\, AIL can analyze unstructured data collected via a n advanced Crawler manager or from different feeders such as PasteBin-alik e sites\, Twitter\, Discord\, Telegram Stream providers\, or custom feeder s.\n\nAIL supports active crawling of Tor hidden services\, protected webs ites and forums with pre-recorded session cookies. Its modular design allo ws for easy contribution and extension\, enabling the addition of new Anal yzer modules\, feeders\, or streams without the need to know the inner wor kings. The framework also has integrations with other open source projects such as MISP or cve-search.\n\n\nThis presentation will focus on the late st version of the AIL framework (v5.0) and its new features. Attendees wil l learn about the following:\n- An overview of the modular design of AIL a nd its extensibility through Analyzer modules\, feeders\, and exporters.\n - Demonstrations of how the new features can be used in practice\, includi ng practical examples of investigating Tor hidden services and other sourc es of data.\n- Best practices for data collection and analysis with AIL\, including performance optimization techniques and integration with other o pen source projects such as MISP.\n\nJoin us for this exciting presentatio n and learn how AIL can help you with your data analysis and threat detect ion needs.\n\nhttps://github.com/ail-project/\n\nhttps://github.com/ail-pr oject/ail-framework DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Data Mining\, Darknet and Social Network Monitoring - Exploring the Latest Features of the AIL Framework - Aurelien Thirion URL:https://cfp.pass-the-salt.org/pts2023/talk/8MS9ZL/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-T9XQNG@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T113500 DTEND;TZID=CET:20230704T121000 DESCRIPTION:Reproducible research is generally speaking a good idea we all agree on\, but can be a bit of a nightmare when dealing with hardware -- a nd actually\, even software. In this presentation\, I will talk about repr oducibility in the context of academic security\, and more precisely the r eproducibility of attacks on micro-architecture. \n\nIn a first part\, we will see the limits of "just sharing code" in terms of reproducible resear ch. In a second part\, we will explore the good\, the bad\, and the ugly o f trying to reproduce micro-architectural attacks. Finally\, we will discu ss a great (and quite recent) initiative of academic security conferences: artifact evaluation. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Reproducible Research in Micro-architecture Security (and Beyond): from Paper to Artifact Evaluation - Clémentine Maurice URL:https://cfp.pass-the-salt.org/pts2023/talk/T9XQNG/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-YAJN93@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T140000 DTEND;TZID=CET:20230704T143500 DESCRIPTION:Rust is an increasingly popular systems programming language\, especially thanks to its memory safety guarantees and more general focus o n safety.\nThis talk will give an overview of where it stands regarding th e software supply-chain security challenges\, including vulnerability mana gement across the ecosystem\, dedicated tooling and integration into large r efforts (OpenSSF projects\, etc.)\n\nIt will cover the topic from both a n internal (as a member of the Rust Secure Code WG) and an external (as a software editor using Rust) point of view. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Supply-chain security in open-source ecosystems: the Rust case - Al exis Mousset URL:https://cfp.pass-the-salt.org/pts2023/talk/YAJN93/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-9XNUZL@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T143500 DTEND;TZID=CET:20230704T151000 DESCRIPTION:The last few years have seen a significant raise in Supply Chai n attacks targeting third party software used in larger projects. With the need for developers to attest of the integrity and provenance of their so ftware dependencies\, alternatives have emerged to make tracing software b ack to the source more accessible\, without a need for specific knowledge of cryptographic protocols used for generating and verifying artifact sign atures.\n\nProject Sigstore (https://www.sigstore.dev/) is a new standard for signing\, verifying and protecting software. This talk will provide an introduction to Sigstore\, explaining the different components the projec t is built upon and how developers can use it to sign and verify software artifacts (software packages\, container images...) in a secure way. Notab ly\, Sigstore solves the issue of private key storage and management by im plementing "keyless" signing\, where users can generate ephemeral key pair s and sign an artifact using an identity provider such as GitHub\, Microso ft or Google. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Introduction to Sigstore: cryptographic signatures made easier - Ma ya Costantini URL:https://cfp.pass-the-salt.org/pts2023/talk/9XNUZL/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-NQY3WL@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T151000 DTEND;TZID=CET:20230704T154500 DESCRIPTION:Hashlookup aim is to index the hashes of all the published and released software. It crawls and indexes the hashes from many different pu blic sources which include Linux distributions\, operating systems such as Windows or alternative distributions. The goal is provide a fast and effi cient way for analysts\, digital forensic investigators and security resea rchers contextual information about published software. hashlookup goal is to support digital forensic investigation but also the review of software supply chain and distribution channels. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:How to Secure Your Software Supply Chain and Speed-Up DFIR with Has hlookup - Alexandre Dulaunoy URL:https://cfp.pass-the-salt.org/pts2023/talk/NQY3WL/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-9H8FH3@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T161500 DTEND;TZID=CET:20230704T163500 DESCRIPTION:Nowadays structured firmwares can be a complete OS with thousan ds of files. It usually requires several hours to find the links between s ome components\, and it is easy to get lost in this mass of information.\n This talk will introduce how we have combined and extended already existin g open-source solutions to solve this issue and help reversers in their da ily tasks. The resulting tool\, Pyrrha\, allows users to visualize the dif ferent binaries and libraries of the firmware and their interactions in th e form of several dependency graphs. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Map your firmware! - Eloïse Brocas URL:https://cfp.pass-the-salt.org/pts2023/talk/9H8FH3/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-LZHYRS@cfp.pass-the-salt.org DTSTART;TZID=CET:20230704T163500 DTEND;TZID=CET:20230704T165500 DESCRIPTION:AI tools have broken out spectacularly in 2022\, offering image generation\, video upscaling\, text completion\, and much more.\nThe rece nt release of OpenAI's ChatGPT led researchers to discover that the new la nguage model had unexpected security engineering capabilities. In particul ar\, this talk explores the use of the davinci-003 model to automatically comment decompiled functions and suggest new names for their variables.\n\ nThis led to the creation of Gepetto\, an IDA Pro plugin that extracts inf ormation from the tool and submits it into OpenAI's API to speed up the an alysis dramatically for the rough equivalent of 1$ per day.\n\nThe plugin' s code is available here: https://github.com/JusticeRage/Gepetto DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Gepetto: AI-powered reverse-engineering - Ivan Kwiatkowski URL:https://cfp.pass-the-salt.org/pts2023/talk/LZHYRS/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-A3GZXD@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T094000 DTEND;TZID=CET:20230705T124000 DESCRIPTION:Scapy (https://www.scapy.net & https://github.com/secdev/scapy) is a powerful Python-based interactive packet manipulation program and li brary. It can be used to forge or decode packets for a wide number of prot ocols\, send them on the wire\, capture them\, match requests and replies\ , and much more. DTSTAMP:20260910T045848Z LOCATION:Workshop room SUMMARY:Scapy Hands-on - Guillaume Valadon URL:https://cfp.pass-the-salt.org/pts2023/talk/A3GZXD/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-9ZH9NP@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T100000 DTEND;TZID=CET:20230705T103500 DESCRIPTION:Local file inclusion methods in PHP evolved through time\, ther e are 2 main objectives when exploiting them:\n- Getting a remote code exe cution by including files containing PHP via include() or require() functi ons.\n- Leak local files such as PHP sources or configuration files via fi le_get_contents() or file() functions for example.\n\nIn the past\, the fo llowing requirements had to be met to exploit a local file inclusion.\nTo exploit a remote code execution you could inject information in log files and include them\, or control a variable in your PHP session to poison the session file. But in most cases\, you needed to be able to upload a file on the system.\nTo leak local files\, it was required to either fully cont rol the path pointing to the file to leak\, or to have a path traversal to go up in the file tree. Most importantly\, it was mandatory for the serve r to send you back its content in the response.\n\nIn both cases\, the aff ected functions support several wrappers\, the most iconic being file:// w hich is a prefix before a file path. Other wrappers such as php://filter c an be passed on these methods and for example it was well known to allow l eaking PHP sources by base64 encoding them (ex : php://filter/convert.base 64-encode/resource=index.php). \nIn a 2021 CTF write-up by loknop \, this wrapper was actually proven to be much more useful. Indeed\, it allows set ting the encoding of contents passing through it\, and most importantly to chain an infinite number of encodings leading to the generation of arbitr ary data at the start of a file. In this presentation\, the full process w ill be explained with examples allowing\, for instance\, to generate inter esting prefixes to a file content\, such as ''\, th erefore removing the need to have a file upload when exploiting include() or require() functions to get remote code execution (if the full path is c ontrolled).\n\nIn 2022\, hash_kitten showed that it was also possible to u se PHP filters chain as an error-base oracle when used in many built-in fu nctions\, such as file_get_contents(). Its method chains encodings that wi ll make the content size of a file exponential\, triggering a PHP memory_l imit exhaustion. By using other filters\, the first character of the file content can also be determined. By using other encodings it is also possib le to rotate the chain order to retrieve characters that are located furth er away in the content.\nUsing this error-based oracle\, it is therefore p ossible to leak the entire file content without having PHP to serve it in a server response. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:PHP filter chains: How to use it - Rémi Matasse (Security research \, Synacktiv) URL:https://cfp.pass-the-salt.org/pts2023/talk/9ZH9NP/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-LQ7RVH@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T103500 DTEND;TZID=CET:20230705T105500 DESCRIPTION:Over the last few years\, the popularity of proving systems bas ed on zkSNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowle dge) has risen\, typically due to real-world use cases such as private aut hentication\, private set membership\, proofs of correct execution by a no n-trusted entity and more.\n\nThere are different proving systems that hav e been proposed in the last 5-7 years (Groth16\, Marlin\, PLONK\, TurboPLO NK\, etc.)\, with their primary objectives being reducing the size of the proof\, reducing the proving/verifying time and minimizing the need for a trusted setup. Further\, there are different ways to implement zkSNARKs\, but the common idea behind all of them is that the construction has to be represented in an arithmetic circuit on top of a finite field. This is pos sible using domain-specific languages (DSLs) such as Circom or Leo\, or us ing a library such as gnark\, Halo2 or arkworks-rs.\n\nIn the aforemention ed applications\, typically\, encryption and hashing operations are needed . However\, the performance of traditional designs such as AES or BLAKE2 i s not optimal in circuits. This has led to the apparition of arithmetizati on-oriented constructions for hashing and encryption. Moreover\, the Spong e API for Field Elements (SAFE API) has been recently proposed\, which can be used to create different cryptographic primitives for zkSNARK circuits using the sponge construction. In many cases\, the performance of this ty pe of constructions and the difficulty of implementing them using modern l ibraries for creating circuits has not been evaluated.\n\nIn this talk\, w e present zekrom\, an open-source library of arithmetization-oriented cons tructions for zkSNARK circuits. The goal of zekrom is to analyze the perfo rmance of novel constructions for circuits using modern libraries such as arkworks-rs and Halo2 and frameworks such as the SAFE API. Other goals of zekrom are: 1) to provide recently proposed arithmetization-oriented const ructions for creating privacy-friendly applications based on zero-knowledg e proofs\, 2) to help developers by providing tools to generate the type o f parameters that this type of constructions require\, and 3) to provide a reusable implementation of the SAFE API that can be easily adapted to new proposed permutations for circuits. Finally\, in our talk\, we'll describ e the obstacles we have found when implementing this type of construction. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:zekrom: an open-source library of arithmetization-oriented construc tions for zkSNARK circuits - Antonio de la Piedra\, Laurent Thoeny URL:https://cfp.pass-the-salt.org/pts2023/talk/LQ7RVH/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-ZQAXNB@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T112500 DTEND;TZID=CET:20230705T114500 DESCRIPTION:Edition of DER encoded ASN.1 structures is a pretty tedious wor k when done manually.\nSolutions to this problem exist. For instance\, der -ascii [0] is a tool written in Go that helps with back and forth conversi ons from/to DER structures to/from a textual representation using a custom defined language.\nI present a somehow short Perl script [1] that leverag es the OpenSSL configuration language along with the ```ASN1_generate_ncon f(3)``` function in order to achieve the same goal with almost no dependen cies apart from Perl and OpenSSL.\nThis tool can be used to ease the explo itation of CVE-2022-0778 [2] & [3].\n\n[0] https://github.com/google/der-a scii\n[1] https://github.com/wllm-rbnt/asn1template\n[2] https://www.opens sl.org/news/secadv/20220315.txt\n[3] https://github.com/drago-96/CVE-2022- 0778#using-asn1-templates DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:ASN.1 templating for fun and profit - William Robinet URL:https://cfp.pass-the-salt.org/pts2023/talk/ZQAXNB/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-8TXSWF@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T114500 DTEND;TZID=CET:20230705T120500 DESCRIPTION:Ensuring the seamless flow of threat intelligence between shari ng communities\, CTI pipelines\, and detection engineering teams heavily r elies on the interoperability of CTI standards. \nTo achieve this\, the [ `misp-stix`](https://github.com/misp/misp-stix) Python library (>=3.8) was developed and specifically designed to handle all conversions between the MISP standard format and STIX formats. \nThis library serves as a versat ile and comprehensive solution that addresses the challenges faced in CTI standard conversion. \nIn this talk\, we will discuss the implementation of `misp-stix`\, which provides a generic Python library that supports var ious formats and conversions. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:How to survive to STIX parsing? - Christian Studer URL:https://cfp.pass-the-salt.org/pts2023/talk/8TXSWF/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-HMTA3X@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T140000 DTEND;TZID=CET:20230705T143500 DESCRIPTION:We often use Wireshark to analyze Windows and Active Directory network protocols\, especially those juicy RPC! But we are often interrupt ed in our enthusiasm by the payload dissected as “encrypted stub data” . Until we discover that Wireshark has a helpful feature to decrypt this t raffic\, which is protected by secrets derived from the prior Kerberos or NTLM authentication. We will briefly describe the theory and show in pract ice how to configure Wireshark\, and fill the required keytab file\, so th is “encrypted stub data” gets decrypted. This feature will offer you m ore visibility into those protocols in your future network analysis sessio ns (security research\, network forensics\, etc.) DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Decrypt Kerberos/NTLM “encrypted stub data” in Wireshark - Clé ment Notin URL:https://cfp.pass-the-salt.org/pts2023/talk/HMTA3X/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-EQL3KQ@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T143500 DTEND;TZID=CET:20230705T151000 DESCRIPTION:Suricata can be used to provide visibility and build detection of lateral movement in Windows environment using dedicated signatures or a nalysis of network security monitoring data. The talk will provide practic al methods to increase visibility and provide detection of attacks. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Using Suricata to detect lateral movement in Windows environment - Éric Leblond URL:https://cfp.pass-the-salt.org/pts2023/talk/EQL3KQ/ END:VEVENT BEGIN:VEVENT UID:pretalx-pts2023-UV9F9J@cfp.pass-the-salt.org DTSTART;TZID=CET:20230705T151000 DTEND;TZID=CET:20230705T154500 DESCRIPTION:Despite strong public statements that they want "a safer intern et for everyone"\, many states appear to be double-dealing in the cyber-sp ace and engage in the very activities they discourage. In order to convinc e decision-makers to genuinely discuss acceptable behavior in the cyberspa ce\, we need to give up on moral arguments and focus on pragmatic reasons to favor defense. But the incentives towards offense may just be too stron g. DTSTAMP:20260910T045848Z LOCATION:Amphitheater SUMMARY:Why cyberoffense will never be regulated - Ivan Kwiatkowski URL:https://cfp.pass-the-salt.org/pts2023/talk/UV9F9J/ END:VEVENT END:VCALENDAR