POSITIVE HACK DAYS

Authors: Artur Garipov and Pavel Novikov

Many services are based on mobile technology security — from GSM/GPRS modems employed in ICS to two-factor authorization set up by a regular cell phone user to work with e-mail or bank cards.

The speakers will conduct a workshop on mobile traffic interception (USSD, SMS, GPRS) and subscriber cloning. Everyone is welcome to give it a try. The organizers will provide all necessary equipment except for laptops.

Language
Russian

Artur Garipov and Pavel Novikov

The Revenant

Author: Andrey Masalovich

The whole range of means of information influence is used in both corporate communications marketing and astroturfing. The speaker will talk on how information attacks are developed, how to detect them at an early stage, and how to resist them. He will analyze the perception of information and the diffusion of information in social networks by using bots and trolls. The report also includes a quick social test of common participants of mass discussions.

Language
Russian

Andrey Masalovich is a member of the board of directors and the head of competitive intelligence group at DialogueScience. Runs several successful projects aimed at providing analytics for banks, business groups, large retail groups, and governmental organizations. The creator of the search engine Avalanche. He served as a lieutenant colonel of the Russian Federal Agency of Government Communications and Information. He has a PhD in physics and mathematics. A distinguished scientist, he was awarded a scholarship by the Russian Academy of Sciences in 1993. He has published works on data search and analysis. He conducted workshops in a number of universities in Russia and the US (Harvard, Stanford, Georgia Tech, Texas A&M). An expert for such organizations as RFBR, INTAS, ITC, APEC.

Andrey Masalovich

Targeted Attacks: Be the First to Aim

Author: Vladimir Ivanov and Sergey Gordeychik

An IT expert and a cybersecurity researcher will share their views on the problem of today's targeted attacks sponsored by governments and criminal groups. The speakers will discuss the effectiveness of existing approaches for the protection, methods of bypassing a sandbox, and whether IDS and AV are obsolete.

Language
Russian

Info
Presentation

Vladimir Ivanov
Graduated from the Faculty of Computational Mathematics and Cybernetics, Lomonosov Moscow State University. He has more than 10 years of experience in networks design and development of network protection systems in the world’s largest companies inside and outside Russia. 5 years of project and team lead experience. Vladimir is in charge of the efficiency, security, and performance of the network and services at Lamoda.

Sergey Gordeychik
Sergey is responsible for leading technological development at Kaspersky Lab. His professional interests include security assessment, incident response services, and research on vulnerabilities of banking, telecommunications, and industrial systems. Former CTO at Positive Technologies, Systems Architect and Trainer at the Informzaschita group of companies. Sergey has developed a number of training courses on wireless networks security and security assessment of web applications, etc.

Vladimir Ivanov and Sergey Gordeychik

Waf.js: How to Protect Web Applications Using JavaScript

Authors: Denis Kolegov and Arseny Reutov

The speakers will demonstrate how client-side JavaScript injection may be used to detect and prevent various attacks, search for vulnerable client components, detect leakage of data about web app infrastructure, and find web bots and malicious tools. In addition, they will share their own injection detection methods that employ syntax analyzers without signatures or filtering regular expressions, and discuss implementation of client-side JS honeypot to capture SSRF, IDOR, command injection, and CSRF attacks.

Language
Russian

Denis Kolegov is a web application security researcher at Positive Technologies, PhD, associate professor of Information Security and Cryptography Department at Tomsk State University. He has spoken at numerous security conferences, including ZeroNights, Positive Hack Days, SibeCrypt, and Codefest. With a collaborative research regarding HTTP covert timing channels, he is listed in the Top 10 Web Hacking Techniques of 2014. Prior to joining Positive Technologies, Denis was a senior security engineer at F5 Networks.

Arseny Reutov is a web application security researcher at Positive Technologies. He has participated in various CTF contests and bug bounty programs and is acknowledged by Zend, Nokia, Yandex, Barracuda and others. He participates in such infosec conferences as ZeroNights and CONFidence as a speaker and Positive Hack Days as an organizer. With a collaborative research regarding bruteforce of PHPSESSID, he is listed in the Top 10 Web Hacking Techniques of 2012. He has been maintaining the web security blog raz0r.name since 2008.

Denis Kolegov and Arseny Reutov

If You Find One, There are Probably More! A Detection Method of “Reproduced” Vulnerability

Author: Asuka Nakajima

In a software development process, it is common to reuse source code from other software products to reduce development costs. However, if a vulnerability lurks in the original source code, it will be copied to the developing product. The speaker propose an uncommon method to detect “reproduced” vulnerabilities in binary files, without going through the source code or symbol files.

Language
English

Info
Presentation

Asuka Nakajima is a researcher at NTT Secure Platform Laboratories. She studied at the Faculty of Environment and Information Studies at Keio University. Her research interests include reverse engineering and vulnerability discovery. She is a member of the executive committee of SECCON, the largest CTF organizer in Japan. She is also a founder of CTF for GIRLS, the first security community for woman in Japan.

Asuka Nakajima

A Basic Course in Hacking Web Apps

Author: Mikhail Firstov

The speaker will talk about the real-life cyberattacks on web applications (targeting both the server and client side) and provide the participants with a practical workshop to test their knowledge. This hands-on-lab is designed for both novices and experienced professionals.

Language
Russian

Mikhail Firstov

—No viruses? I wouldn't be so sure

Author: Olga Zinenko

Ural Security Systems Center (USSC) is performing an independent testing of mobile antiviruses for Android (including Dr.Web, Kaspersky, Norton, ESET). The fast track talk will present the current results of the research.

Language
Russian

Info
Presentation

Olga Zinenko is an analyst at Ural Security Systems Center (USSC). An author for the USSC blog that regularly posts surveys of amendments in the legislation. Holds a degree from Ural Federal University. Certified in CompTIA Security +.

Olga Zinenko

Reverse Engineering of Binary Structures Using Kaitai Struct

Author: Mikhail Yakshin

The report will cover current approaches to reverse engineering of binary files: where to start, what's expected at the end, and what tools are typically used. The speaker will demonstrate Kaitai Struct, a new declarative language used to describe various binary data structures, collecting the results into ready-made libraries in supported languages such as C++, Java, JavaScript, Python, and Ruby. Some practical examples of reverse engineering will contribute to better understanding of this issue.

Language
Russian

Info
Presentation

Chief Linux developer for Whitebox Labs, a Swiss-based company that develops open-source hardware and software for managed ecosystems (i.e. reef aquariums, terrariums, aquaponics, hydroponics, etc.), reverse engineering third-party proprietary component communication protocols.

Mikhail Yakshin

Aspects of Insiders' Activity Within a Company

Author: Sergii Kavun

This work describes the author's own insider detection methodology. The new technique represents mathematical tools applied to various security systems.

Language
Russian

Info
Presentation

Dr. Sergii Kavun got his PhD in computer science from the Kharkiv Military University (Ukraine) in 2000. He was awarded with a habilitation degree (Dr.Sc.) in Economics in 2014. He is an accredited specialist of Management of Information Security by standard ISO 17799:2005 (ISO 27002:2005). He has published manuscripts on the topic of information and economic security in strictly peered scientific journals. He is the editor-in-chief of several international journals: Information Security and Computer Fraud, American Journal of Information Systems, Journal of Computer Networks. He was also elected a program board member of organizing committees of the international conferences: Securіtatea іnformationala, European Intelligence and Security Informatics Conference, Information Security — Today and Tomorrow, IEEE International Conference on Intelligence and Security Informatics.

Sergii Kavun

Scalable and Effective Fuzzing of Google Chrome

Author: Max Moroz

The talk includes an overview of ClusterFuzz, Chrome’s distributed fuzzing system that finds security bugs in real time and provides reproducible test cases for every crash, and describes advantages of usage of different sanitizers and LibFuzzer (a library for guided fuzzing). It also covers detailed statistics of the types of bugs found in Chrome and provides an insight into the trials and tribulations of distributed fuzzing, including how you can run your own fuzzers on Google’s infrastructure and earn Chrome bounties for bugs your fuzzer finds.

Language
Russian

Info
Presentation

Max Moroz is an information security engineer at Google Chrome Security Team and a graduate of the Information Security Department of National Research Nuclear University MEPhI (Moscow Engineering Physics Institute). He is also the founder of the CTF team named BalalaikaCr3w and an active participant in CTF competitions and bug bounty programs.

Max Moroz

Real and Formal Security: Born to Be Together

Author: Mikhail Emelyannikov

Technical security, i.e. vulnerability analysis, penetration tests, implementation of safety tools, is often considered as real, practical security as opposed to formal security. The speaker will show that these two types of security complement each other and it is impossible to solve actual security problems by using only one of them. Even when solving technical problems, it is easier to use the language of formal safety in communication with top managers. The speaker will present various case studies on the issue.

Language
Russian

Info
Presentation

Mikhail Emelyannikov, a cofounder of the consulting agency Emelyannikov, Popova and Partners, possesses over 30 years’ experience in the security field. He specializes in solving complex problems of risk management in the IT environment, concerning legal, organizational, and technical issues. He regularly consults the largest international companies on compliance with the Russian laws. For years, he has been the member of expert groups, councils, commissions at the Federation Council, the Ministry of Telecom and Mass Communications, Roskomnadzor, the National Council for Financial Markets. He is the author of numerous publications in the mass media and has elaborated the first Russian training course on the protection of trade secrets and personal data.

Mikhail Emelyannikov

Pseudo-Security of NFC Services

Author: Lev Denisov

The Moscow public transport system is one of the largest in the world. More than five million passengers use the Troika card to pay fare for metro and ground transport. Due to new services, it is now possible to recharge the card via a cell phone with NFC. The speaker will discuss vulnerabilities that allow anyone to get access to card private data, clone the card, and use public transport for free.

Language
Russian

Info
Presentation

Lev Denisov is an expert in contactless payment technologies and automated fare collection (AFC) systems for public transit with more than 10 years of experience. He’s been involved in deployment of 50% of AFC and electronic contactless ticketing projects in Russia. He took part in first roll-outs of NFC payments and contactless payments with bank cards (PayPass, payWave). He is an evaluator and member of the OSPT Alliance. His team pioneered in the implementation of open security standards for contactless payments in public transport, as well as host card emulation for NFC payments. Speaks at specialized conferences, exhibitions, and forums (InfoSecurity Russia, UITP World Congress, Russian Public Transport Week).

Lev Denisov

A Device Fingerprint as a Cure for Fraud. It All Depends on Dosage

Author: Evgeny Kolotinsky

A device fingerprint or browser fingerprint is a typical way of collecting data about a user or device for the purpose of identification on the internet. The speaker will illustrate the accuracy and reliability of the method. You will learn why TOR browser does not always help against tracking and that your web browsing is even less anonymous than you think. Users are being tracked by every website they visit, but it is not always intended for profit.

Language
Russian

Info
Presentation

The lead of the fraud prevention research group at Kaspersky Lab. He has worked in the company for more than 7 years. Engaged in the study of threats not related to viruses. Presented his reports at international conferences on information security.

Evgeny Kolotinsky

Brute-Forced in Sixty Seconds

Author: Nikolay Anisenya

The vast majority of users prefer dictionary passwords, modified according to certain rules, instead of randomly generated. Such rules can be found on the internet, but they are compiled semi-automatically or manually by using password hashes from leaked databases without considering some peculiarities (e.g. how such personal data as name and birth date are used in passwords). The moderator will describe a rule-based bruteforce attack, suggest a method of shortening a list of rules for attack optimization, and compare his approach with other existing solutions.

Language
Russian

Info
Presentation

Nikolay is a mobile application security specialist at Positive Technologies. He is a postgraduate of the Information Security and Cryptography Department at Tomsk State University. Graduated from the Faculty of Applied Mathematics and Cybernetics. Since 2011, he’s been participating in CTF contests as a member of SiBears.

Nikolay Anisenya

NFC: Naked Fried Chicken

Author: Matteo Beccaro

This talk is about transportation security, frauds, and technological failures with focus on a general methodology for professional and amateur pentesters. The speaker will cover some severe vulnerabilities in real-world transportation systems based on NFC technologies and introduce an open-source application designed to pentest such systems via a smartphone.

Language
English

Info
Presentation

Matteo Beccaro is a security researcher enrolled in Computer Engineering at the Polytechnic University of Turin. His research focuses on network protocols, NFC and EACS security. He is also the co-founder and CTO of Opposing Force, the first Italian company specialized in offensive physical security. He spoke at such international conferences as DEF CON 21, 30C3, Black Hat USA Arsenal 2014, DEF CON 22 Skytalks, Black Hat Europe 2014, Tetcon 2015, DEF CON 23, and ZeroNights 2015.

Matteo Beccaro

How to Become the Sole Owner of Your PC

Author: Positive Research

The speakers will tell you about a no-frills way to disable Intel AMT and become the sole owner of your PC.

Language
Russian

Positive Research

Andy, the Polluters, Rick Deckard, and Other Bounty Hunters

Author: Alfonso de Gregorio

This talk is about the vulnerability supply chain, its participants, and ethical questions that arise in the business. The speaker will explain his approach to such issues from the point of view of a zero-day exploits broker and will cover ethical principles and standards set forth in the Code of Business Ethics that he adopted.

Language
English

Info
Presentation

Alfonso De Gregorio is a security technologist, the founder of BeeWise, a principal security researcher at secYOUre, and the director of Zeronomi.com (a premium zero-day exploit acquisition platform). He also served as the chief security architect at an HSM vendor, as an expert at European Commission, and a visiting scholar at the Computer Security and Industrial Cryptography (COSIC) research group. He has been a speaker at PHDays, CODE BLUE, HITB GSEC, HITBSecConf, ZeroNights, DeepSEC, AusCERT, and many other international security conferences.

Alfonso de Gregorio

The City Never Sleeps

Authors: Denis Makrushin and Yuri Namestnikov

Among other things, security professionals rely on strict security policies of limiting internet access for applications to deter cybercriminals roaming through corporate infrastructure. Corporate protection is mostly based on the use of the whitelisting paradigm: to forbid everything that is not clearly permitted. However, when employees go to sleep, many dangers lurk within corporate networks. We will show you how cybercriminals manipulate Notepad, AutoCAD, Tomcat, and SQL Server.

Language
Russian

Info
Presentation

Denis Makrushin is an expert of the Global Research and Analysis Team at Kaspersky Lab. He specializes in analysis of possible threats and regularly speaks at international conferences on information security. Denis was engaged in penetration testing and security auditing of corporate web applications, stress testing of information and banking systems for resistance to DDoS attacks. He graduated from Moscow Engineering Physics Institute (MEPhI). Continues his research on protection against DDoS attacks as a part of his postgraduate course at MEPhI.

Yury Namestnikov started his career as a virus analyst at Kaspersky Lab in 2007. In July 2011, he joined the Global Research and Analysis Team (GReAT) and now specializes in analyzing advanced persistent threats, collecting and examining malware data. He is also involved in research into mobile threats and malware, exploit kits and web application security issues.

Denis Makrushin and Yuri Namestnikov

How We Developed the Federal Standard of SSDL

Author: Alexander Barabanov

The speaker will talk about the national standard “Data Protection. Secure Software Development. General Requirements” being developed at the commission of the Russian Federal Service for Technical and Export Control. He will provide general information about the document and the basic requirements for secure software development.

Language
Russian

Info
Presentation

Alexander has a PhD in computer science. He is a specialist in IT security evaluation and certification, CISSP, CSSLP. Director of the Certification and Testing Department at Echelon (an information security system integrator). Associate Professor at the Information Security Department of Bauman Moscow State Technical University.

Alexander Barabanov

Electronic Access Control Security

Author: Matteo Beccaro

The workshop focuses on exploiting techniques of modern EAC systems. It is designed to introduce the most common access control technologies and provide details on their vulnerabilities and available attack methods. Attendees will test learned methods and win hardware gadgets offered by Opposing Force.

Language
English

Info
Presentation

Matteo Beccaro

Thanks SAP for the Vulnerabilities. Exploiting the Unexploitable

Authors: Dmitry Chastukhin and Dmitry Yudin

Blah blah blah SAP. Blah blah blah big companies. Blah blah blah hack multimillion-dollar systems. This is how typical SAP talks are started. But not this time. We are really missing hardcore exploitation stuff and unusual vulnerabilities. Now it's time for real SAP hardcore! The moderator will tell (and show) how, by using a chain of minor vulnerabilities in different SAP services, you can take complete control over an affected system.

Language
Russian

Info
Presentation

Dmitry Chastuhin, Director of the security consulting department at ERPScan. He is engaged in SAP security, particularly in web applications and Java, HANA, and mobile solutions. He has official acknowledgements from SAP for vulnerabilities he found. Dmitry is also a WEB 2.0 and social network security geek and is very active in bug bounty programs (he found several critical bugs in Google, Nokia, and Badoo). He is a contributor to the EAS-SEC project. He spoke at such conferences as Black Hat, Hack in the Box, DeepSec, and BruCON.

Dmitry Yudin, a security researcher at ERPScan. He is an exploit developer, bug hunter, and Linux fan.

Dmitry Chastukhin and Dmitry Yudin

Security Automation Based on Artificial Intelligence

Author: Rahul Sasi

It is clear that traditional web application security scanners are incapable of finding logical security bugs. The speaker will show users how they can build tools that detect such bugs by using machine learning as a key ingredient. The talk is for cloud-based application security enthusiasts.

Language
English

Rahul Sasi has over seven years of experience in security, research, and product development. He has authored multiple security tools, advisories, and articles. He spoke at various security conferences: Black Hat, CanSecWest, CoCon, Ekoparty, HITB, HITCON, Nullcon. He is the founder and CTO of CloudSek, a risk assessment company. Prior to founding CloudSek he was a senior engineer at Citrix.

Rahul Sasi

DDoS Mitigation Workshop

Author: Krassimir Tzvetanov

This DDoS mitigation hands-on lab focusing on such popular attacks as SYN flood, Sloworis, etc. will demonstrate how specific tools are used to execute the attacks. The attendees will have an opportunity to dissect pre-recorded traffic and to mitigate an attack on an nginx server.

Language
Russian

Krassimir Tzvetanov is Principal Security Engineer at A10 Networks. His primary focus is threat intelligence, software and systems security research, and security software development practices. He also runs the Product Security Incident Response Team (PSIRT). In his previous engagements with Cisco Systems, Yahoo!, and Google, he was focusing on threat intelligence, penetration testing, designing and securing the edge infrastructure of production networks. He was also a department lead for DefCon and an organizer of BayThreat.

Krassimir Tzvetanov

Exploiting Redundancy Properties of Malicious Infrastructure for Incident Detection

Author: John Bambenek

The cat-and-mouse game between malware researchers and malware operators has been going for years. The defense community is getting faster at responding to growing threats and taking down command and control centers of malware operators before they causes too much damage. Meanwhile, “bad guys” are building multitier redundant architectures utilizing P2P networks, Tor, and domain generation algorithms (DGA) to improve availability of supporting infrastructure against take-down operations. This report will cover the research of both American and Russian analysts into the use of such techniques and what can be learned about the adversaries who use them. Additionally, the speaker will introduce a new tool that helps researchers dig into DGAs.

Language
English

Info
Presentation

John Bambenek is a manager of threat systems at Fidelis Cybersecurity and an incident handler with the Internet Storm Center. He has been engaged in security for 17 years researching security threats. He is a published author of several articles. He has participated in many incident investigations spanning the globe. He speaks at conferences around the world and runs several private intelligence groups focusing on takedowns and disruption of criminal entities.

John Bambenek

Copycat Effect: From Cyberforensics to a Street Robbery

Author: Sergey Golovanov

Everybody watches everybody. We got accustomed to cyberattacks financed by governments. The internet is overloaded with such examples and exploits. Intruders propelled by an itch for money find this information useful, of course. The report will cover methods cybercriminals adopted from different special forces departments. The speaker will also tell about new methods of hacking ATMs — and a lot more.

Language
Russian

Sergey is the principal security researcher at Kaspersky Lab. Conducts research into banking threats and cyberespionage. Sergey’s areas of expertise include embedded system security, cybercriminal groups, non-Windows threats (Mac OS, Unix OS), botnets.

Sergey Golovanov

DNS as a Defense Vector

Author: Paul Vixie

DNS offers a commanding view of both the local and global internet, and provides unparalleled intelligence on cybercriminals and attack methods. This lecture will explain how DNS can be protected, and how it can be used to protect other connected targets. In his presentation, the speaker will provide an overview of cache poisoning, DNSSEC, DDoS, rate limiting, DNS firewalls with RPZ, and passive DNS monitoring.

Language
English

Info
Presentation

Dr. Paul Vixie is the CEO of Farsight Security. He is a former chairman of Internet Systems Consortium, President of MAPS, PAIX and MIBH. He served on the ARIN Board of Trustees and was a founding member of ICANN Root Server System Advisory Committee and ICANN Security and Stability Advisory Committee. Vixie has been contributing to internet protocols and UNIX systems as a protocol designer and software architect since 1980. He wrote Cron (for BSD and Linux), and is considered the primary author and technical architect of BIND 4.9 and BIND 8. He has authored or co-authored a dozen of RFCs, mostly on DNS and related topics. He earned his PhD from Keio University for work related to DNS and DNSSEC, and was named to the Internet Hall of Fame in 2014.

Paul Vixie

Web Application Firewall Bypassing

Author: Khalil Bijjou

This workshop will teach you how to attack an application secured by a WAF. The moderator will describe WAF bypassing techniques and offer a systematic and practical approach on how to bypass web application firewalls based on these techniques. Even beginners are welcome! WAFNinja, a tool that helps to find multiple vulnerabilities in firewalls, will be introduced.

Language
English

Info
Presentation

Khalil Bijjou is an enthusiastic ethical hacker who is currently in the master's course of IT security. He works as a penetration tester for Deloitte Cyber Risk Services and performs security assessments for major companies. Khalil reached the 2nd place of the German Post IT Security Cup.

Khalil Bijjou

EAST 4 SCADA

Authors: Emil Oleynikov, Dmitry Kazakov, Yuriy Gurkin Assistants: Mikhail Kropachev, Andrey Makhnev, Dmitry Chulkov

The moderators will demonstrate the advantages of a free framework designed in Russia, an alternative to Canvas, Metasploit, Core Impact. Novices and experienced hackers will learn about vulnerabilities in SCADA systems and try to identify and exploit them. Various automated systems will be available for testing (ABB, Siemens, Rockwell, ICP DAS, etc.). Remember to bring along your own devices.

Language
Russian

Emil Oleynikov, an information security researcher, the lead developer of EAST Framework.
Yuriy Gurkin, the chief technology officer of GLEG, a promoter of EAST Framework.
Dmitry Kazakov, a SCADA/PLC consultant and security analyst.
Mikhail Kropachev, a SCADA/PLC security analyst.
Andrey Makhnev, a programmer and tester of EAST.
Dmitry Chulkov, a programmer and tester of EAST.

Emil Oleynikov, Dmitry Kazakov, Yuriy Gurkin Assistants: Mikhail Kropachev, Andrey Makhnev, Dmitry Chulkov

Enterprise Forensics 101

Author: Mona Arkhipova

This report outlines the typical aspects of digital forensics within enterprise systems: from initial data collection to filling a report. The speaker will give a background about the accidental establishment of QIWI Forensic lab.

Language
Russian

Info
Presentation

The head of security monitoring (SOC + OPS), QIWI

Mona Arkhipova

Wireless Hijack: From Quadrocopters to Computer Mouses

Author: Artur Garipov

The talk will focus on general aspects of SDR application for wireless traffic analysis. The speaker will demonstrate how to search and identify wireless devices, analyze and spoof protocols, take over wireless equipment and conduct a Mousejack attack.

Language
Russian

Info
Presentation

Artur Garipov is a network application security specialist at Positive Technologies. He researches security of wireless technologies and mobile systems. Organizer of the MiTM Mobile contest and workshop at PHDays V, VI.

Artur Garipov

Face to Face: the Arbiters of Security

Moderator: Dmitry Gusev, InfoTeCS

Organizations of different types see information security from different standpoints: regulators set rules and requirements; companies ensure the safety and uninterrupted performance of their internal processes and at the same time seek to follow those requirements. Ideologists who create IT ecosystems and develop security solutions see the problems and possible solutions in their own way. How do representatives of these spheres see information security pressing issues? Are they able to solve these problems by themselves using their own tools? Would it be reasonable to join efforts? What IS solutions do developers offer and what is the role of government regulation? These issues will be discussed by the section’s attendees: representatives of government and business, developers of information security tools, CIO and CISO of large companies.

Participants:

Natalya Kaspersky, InfoWatch
Boris Simis, Positive Technologies
Oleg Bosenko, Rosneft
Evgeny Kraynov, Federal Financial Monitoring Service
Kirill Alifanov, E.ON Russia
Sergey Ryzhykov, 1C Bitrix
Ilya Fedorushkin, Tizen
Representative of the Federal Service for Technical and Export Control of Russia
Representative of the Ministry of Telecom and Mass Communications of Russia

Language
Russian

KASan in a Bare-Metal Hypervisor

Author: Alexander Popov

This report discusses the successful experience of porting KASan (a dynamic memory error detector) to a bare-metal hypervisor. The speaker will tell how he managed to improve KASan over its implementation in the Linux kernel.

Language
Russian

Info
Presentation

Alexander is a system software developer (Linux kernel) at Positive Technologies.

Alexander Popov

Privacy and Security in the Internet of Things

Dev

Author: Jeff Katz

Cisco predicts there will be 25 billion devices connected to the internet this year, and double that number by 2020. If you are planning to develop and launch an IoT product, you might be wondering what could happen one day if the FSB comes knocking on your door. The security of your customers should be considered right from the start, and not as an afterthought. This session highlights how it is possible to leverage the benefits of IoT without sacrificing personal rights of your clients. The presentation will draw on real-world examples of connected services with privacy and security designed-in from the start.

Language
English

Info
Presentation

Jeff Katz has extensive experience in professional software and hardware development across a wide range of environments and languages in a large problem space, including physical access control, financial services, e-commerce, home entertainment and vehicles. He is currently focusing on the Internet of Things. As a technologist, architect, full-stack software, hardware and RF engineer, Jeff enjoys getting his hands dirty throughout the entire process and derives satisfaction from building and leading amazing teams and from working with great people on real and interesting problems.

Jeff Katz

How I Became Paranoid in the World of Mobile Devices

Author: Elena Feldman

Nowadays people often debate on the security of mobile messengers. Many developers protect their apps with strong endpoint encryption and extra authentication. The presenter will illustrate the interception of private communications with further transmission of data to a remote server in the context of the popular Viber messenger, installed on a device without root permissions.

Language
Russian

A forensic expert at F-lab. Senior Lecturer at the Department of Computer Security and Applied Algebra of Chelyabinsk State University. Deputy CTO at ER-Telecom. Elena started her career in the telecom industry as a core engineer and network architect. Studies IoT and mobile devices information security.

Elena Feldman

Very Mighty eXtension for debugging

Author: Artem Shishkin

This talk will show how to develop a hypervisor-based debugging facility: how to apply existing hardware features for debugging, how to maintain integrity of a debuggee, how to make this stuff interactive and how to adopt Intel specific peculiarities. The speaker will also cover OS integration and will tell how to build a hypervisor debugger into firmware. Real-world cases of using a hypervisor-based debugger will prove that Virtual Machine Extensions are indeed a Very Mighty eXtension for debugging.

Language
Russian

Info
Presentation

Artem Shishkin is a virtualization specialist and reverse engineer. An author of research papers including "Intel SMEP overview and partial bypass on Windows 8", "Stars aligner's how-to: kernel pool spraying and VMware CVE-2013-1406", and "Microsoft Windows 8.1 kernel patch protection analysis". Engaged in low-level programming and developing reverse engineering tools. Previously spoke at Positive Hack Days and ZeroNights.

Artem Shishkin

Exploiting Chrome on a Nexus Phone

Author: Guang Gong

The speaker will tell how to pwn a Nexus device with a single vulnerability. He will also talk about how to get an RCE permission by using a V8 vulnerability and then demonstrate breaking Chrome's sandbox without exploiting any security flaws.

Language
English

Guang Gong is a security researcher of the Mobile Safe Team of Qihoo 360. His research interests included Windows rootkits, virtualization and cloud computing. He is currently focuses on mobile security, especially on hunting and exploiting Android’s vulnerabilities. He has spoken at several security conferences such as Black Hat, CanSecWest, PacSec, SysCan360. He is the winner of Pwn2Own 2015, Pwn0Rama 2016 (the category of mobile devices), and Pwn2Own 2016 (the target: Chrome).

Guang Gong

Magic box or: A Story about White Hat ATM Hackers

Authors: Olga Kochetova and Alexey Osipov

The report focuses on the most common methods of hacking and protecting ATMs. The speaker continues the topic of her previous presentations with a more in-depth analysis of technical details. The emphasis will be on vulnerabilities in an ATM infrastructure and the security of communication with a processing center.

Language
Russian

Info
Presentation

Olga Kochetova
Olga is a senior specialist of penetration testing department at Kaspersky Lab, the author of many articles and webinars devoted to ATM insecurity. Participated in international conferences: Black Hat, Hack in Paris, Positive Hack Days, Security Analyst Summit. She is also the author of security advisories on various vulnerabilities in ATMs and software of popular vendors.

Alexey Osipov
Alexey is the lead expert of penetration testing department at Kaspersky Lab. He is the author of techniques and utilities for exploiting vulnerabilities in XML. Participated in international conferences: Black Hat, Chaos Communication Congress, Hack in Paris, NoSuchCon, Positive Hack Days. The author of security advisories on various vulnerabilities in ATMs and software of popular vendors.

Olga Kochetova and Alexey Osipov

john-devkit: 100 Hash Types Later

Author: Aleksey Cherepanov

Speeds in hash cracking grow. The number of hashing algorithms grows. Work needed to maintain universal cracker grows too. The problem gave birth to john-devkit, an advanced code generator for the famous password cracker John the Ripper. More than 100 hash types are implemented within john-devkit. Its key aspects will be discussed: separation of algorithms, optimizations and output for different computing devices, simple intermediate representation of hashing algorithms, complexity of optimizations for humans and machines, bitslicing, comparison of speeds.

Language
Russian

Info
Presentation

Aleksey Cherepanov is a programmer fascinated by libre software, participant of GSoC 2012, contributor to John the Ripper, and the author of john-devkit.

Aleksey Cherepanov

Mobile Communications are Insecure. Evidence-Based Arguments

Authors: Sergey Puzankov and Dmitry Kurbatov

Any mobile operator’s networks contain vulnerabilities inherited from obsolete technologies. The report reveals the security level of mobile carriers based on data gathered during the investigation of real-life networks.

Language
Russian

Info
Presentation

Sergey Puzankov
Being an expert at Positive Technologies, he is engaged in the research of attacks against mobile operators’ networks, as well as the development of SS7 Scanner and SS7 Attack Discovery. The author of several publications on SS7 security.

Dmitry Kurbatov
He has 9 years of experience in information security of corporate networks, business applications, and telecommunication equipment. An expert at Positive Technologies and the Positive Research center. Participates in organizing the Positive Hack Days forum. Dmitry has published many articles on information security.

Sergey Puzankov and Dmitry Kurbatov

Memory Protection Based Anti-Cheat for Computer Games

Authors: Roman Kazantsev, Maxim Vafin, and Andrey Somsikov

Customer services with cheat technologies for multiplayer online games is continuously developed because cheat makers do a profitable business specializing in a wide range of games. The speakers will suggest their anti-cheat technique that relies on software obfuscation and protects against code injection cheats that can analyze memory data and collect statistics about players. The talk will be supported by a real case study of Unreal Tournament 4.

Language
Russian

Info
Presentation

Roman Kazantsev is a software engineer at Intel Corporation. With seven-year professional experience, he is currently occupied with delivering cryptographic solutions and expertise for content protection across all the Intel platforms. His professional interests are cryptography, software security, and computer science.

Maxim Vafin is a software engineer at Intel Corporation. He specializes in computer game security and software protection against reverse engineering.

Andrey Somsikov is a software engineer and security researcher at Intel Corporation. His professional interests are software security, cryptography, and computer science.

Roman Kazantsev, Maxim Vafin, and Andrey Somsikov

The CPU Does Not Matter. A Simple Analysis of Binary Files Using IDAPython

Author: Anton Dorfman

This hands-on lab will focus on approaches to automation of a preliminary analysis of binary files. Participants will learn what information can be obtained with IDA Pro, leaving processor architecture features aside. The moderator will also pay attention to fixing IDA's improper recognitions. Practical tasks and their solutions will be given.

Language
Russian

Anton Dorfman is a Candidate of Technical Sciences, researcher, reverser, and assembly language fan. He is a leading expert of the application analysis team at Positive Technologies. Anton is interested in automating any reverse engineering tasks. He was the third in the contest Best Reverser at PHDays 2012. Spoke at HITB, PHDays, and Zeronights. The author of over 50 scientific publications on computer security.

Anton Dorfman

Janitor to CISO in 360 Seconds: Exploiting Mechanical Privilege Escalation

Author: Babak Javadi

For over 100 years, the modern pin tumbler lock has been used as the gold standard of physical security. Unique designs have come and gone over the years, but only the pin tumbler lock has remained constant. Almost just as constant is a neat hack-turned-standard feature that is commonly referred to as Master Keying. Master Keying allows the use of "unique" permissions-based mechanical keys in large systems and remains in use in large business and government installations in every country in the world. Unfortunately, the oldest authentication system in the world still in wide use today is vulnerable to what many consider to be the original privilege escalation attack, predating digital computer systems completely. Known by a handful of locksmiths for decades and first publicly disclosed in 2003, this un-patched vulnerability remains one of the most dangerous and under-protected physical security weaknesses still present today. This talk will discuss a highly optimized attack method against common master keyed systems as it applies to modern locks, and will cover a couple of options for mitigating and defending against the attack.

Language
English

Info
Presentation

Babak Javadi is a hardware hacker with a wayward spirit. His first foray into the world of physical security was in the third grade, where he received detention for describing to another student in words alone how to disassemble the doorknob on the classroom door. After years of immersion in electronics and computer hardware hacking, he found his passion in the puzzling and mysterious world of high security locks and safes. In 2006 Babak co-founded the US division of The Open Organisation of Lockpickers, otherwise known as TOOOL, where he continues to serve on the Board of Directors as President. In the same year, he founded the CORE Group, a multi-disciplined security research and consulting firm. He has recently re-embraced the beauty of the baud and resumed hardware hacking with a vengeance, currently working on leading research from access controls to alarms.

Babak Javadi

From Cyber Offense to Cyber Arms Control: Developing Cybersecurity Norms

Author: Jan Neutze

Increasingly, nation states use the internet to advance intelligence or even military operations: espionage, reconnaissance, and even sabotage. The targets of these operations, whether intentional or not, are often civilians. As the pace of activity in cyberspace increases, so does the likelihood of one state misinterpreting the actions of another. Moreover, the risk of a cyber-arms race cannot be discounted. It would be naïve to hope that states should fully pull back their military operations from the internet. Nevertheless, just as there are universally accepted norms of behavior in other realms of conflict, it is no less important to establish norms for cybersecurity. These norms should not only strengthen cybersecurity but also preserve the freedoms of a globally connected society. In an effort to encourage the international community to reverse the trend of militarizing cyberspace, a robust international debate has emerged discussing ways to reduce cybersecurity conflict by proposing a framework for cybersecurity norms. This discussion will focus on Microsoft’s approach to cybersecurity norms.

Language
English

Jan Neutze is Director of Cybersecurity Policy at Microsoft responsible for cybersecurity policy matters in Europe, Middle East, and Africa.

Jan Neutze

Why We Hack: The Truth

Moderator: Boris Simis, Positive Technologies

Participants will explain why they prefer to study information security and how they estimate the value of their work. Speakers will also discuss how to efficiently attract new researchers (bounty programs, outsourcing, development of an IS department). They will try to describe an image of a future IS researcher.

Participants:

Timur Yunusov, Positive Technologies
Dmitry Evteev, HeadLight Security
Nikita Kislitsin, Group-IB
Omar Ganiev, IncSecurity
Representative of Digital Security

Language
Russian

Crowdsourced Malware Triage

Author: Sergey Frankoff and Sean Wilson

Malware triage is a process of quickly analyzing potentially malicious files or URLs. It is an important function in any mature incident response program. But what if you don’t have an incident response program? What if you are just setting one up? What if you don’t have the tools you need to perform your analysis? With the current offering of free online tools and the right mindset, a web browser and a notepad may be all you need. In this workshop, participants will work through the triage using only free online tools. The moderator will provide an introduction and demo of each tool.

Language
English

Info
Presentation

Sergey Frankoff
A malware researcher and the director of threat intelligence at Sentrant. Prior to joining Sentrant, worked as an incident responder and a security analyst. A strong believer in taking an open community approach to combating cybercrimes. Contributes to open source tools and tries to publish as much as possible. A co-founder of Open Analysis, a group of malware researchers and incident responders who produce open tools and services to assist with malware analysis.

Sean Wilson
A researcher at PhishMe with experience in malware analysis, incident response, and reverse engineering. He is an active contributor to open-source security tools. A co-founder of Open Analysis, a collective of malware researchers and incident responders who produce open tools and services to assist with malware analysis. In his free time, Sean loves fly fishing.

Sergey Frankoff and Sean Wilson

Groundbait: Analysis of a Surveillance Toolkit

Author: Anton Cherepanov

Operation “Groundbait” (Russian: Prikormka) is an ongoing cybersurveillance that took place in Ukraine. The group behind this operation has been launching targeted attacks to spy on individuals with a political motive. The group is active since 2008. The talk will uncover details about the attack campaigns and provide a technical analysis of the used malicious toolkit. The speaker will share clues uncovered during his research that may point to the origin of the attackers.

Language
Russian

Anton Cherepanov graduated from South Ural State University. Works at ESET as a malware researcher. Specializes in IT security, reverse engineering and malware analysis automation. Spoke at CARO Workshop, Virus Bulletin, and ZeroNights.

Anton Cherepanov

A Riddle Wrapped in a Mystery, or Vulnerabilities in Medical and Industrial Software

Authors: Emil Oleynikov and Yuriy Gurkin

Both medical and SCADA systems can be operated, configured, and monitored via remote control. They are often connected to the internet. The speaker will provide an overview of vulnerabilities in application-specific software used in medicine and industrial production. The vulnerabilities were discovered using EAST (exploits and security tools), a framework similar to Metasploit. EAST automates vulnerability scanning and demonstrates possible risks.

Language
Russian

Info
Presentation

Emil Oleynikov, an information security researcher, the lead developer of EAST Framework.
Yuriy Gurkin, the chief technology officer of GLEG, a promoter of EAST Framework.

Emil Oleynikov and Yuriy Gurkin

Fear and Loathing in Telecoms

Author: Ilya Safronov

The report will provide information on various schemes used by attackers to enrich themselves at the expense of telecom operators. The speaker will cover manipulations with numbers, interconnection settings, billing, and switch configuration. The principles of SIM box operation and traffic looping will be also discussed.

Language
Russian

Info
Presentation

Ilya Safronov is an IS specialist, previously worked in the network security department at Positive Technologies and was a security assessment expert at Group-IB. The author of several articles on information security. He has participated in a number of telecommunications projects and research programs.

Ilya Safronov

Experts Don’t Need No Education. Information Security and Other Pseudosciences

Moderator: Boris Simis

Representatives of different information security schools with diverse views on professional education will consider the benefits and flaws of their educational approaches, evaluate recent graduates, and try to define what young specialists should study to adapt to our fast-paced world.

Language
Russian

Defense and Offense Technologies in 2016: Which Side will Make a Breakthrough?

Moderator: Alexey Kachalin

Leading experts from PT Expert Security Center cover the most important events in the world of security and analyze how these events affected their day-to-day practice. What is the probability of detecting newfound vulnerabilities during penetration testing? What changes have taken place in hackers' tactics? The speaker will answer these questions using examples of incident investigation.

Language
Russian

Engineering Systems and Development Errors as the Factor of Security Flaws

Author: Anton Zhbankov

This fast track will examine the relationship between IS incidents and IT problems, engineering and capital development, problems of operation and design. Protection against hackers as well as a detailed code review are very important. Still, if you forget about the rest, you will be acting just like the fairy tale pig who placed a steel door to the thatched hut.

Language
Russian

15 years of experience with expertise in datacenter virtualization and cloud computing. Certified as an EMC Cloud Architect Expert, an eight-time VMware vExpert, was also awarded the EMC Elect designation in 2015.

Anton Zhbankov

Catch Me If You Can

Author: Nikolay Zdobnov

InfoWatch has been active in the market of DLP solutions for more than 12 years. There have been a number of interesting stories over this period: the disclosure of plans for further development of a whole region among competitors, pharmacy workers selling drugs, and corrupt practices within public institutions. The speaker will describe some tricks used by employees to sell out trade secrets at a higher price and make a tidy sum.

Language
Russian

Nikolay is the head of key account management at InfoWatch. He has over five years’ experience in IT and IS. He was engaged in the development of products for information security at Softline Trade, an international integration company. Cooperated with Aladdin Knowledge Systems, Check Point Software Technologies, and RSA Security.

Nikolay Zdobnov

Time is Not on Your Side: Exploiting Browser-Based Timing Attacks

Author: Tom Van Goethem

This talk introduces a new threat: browser-based timing attacks that can be used to extract sensitive information from trusted websites. In a classic example of a timing attack, the attacker retrieves the secret key from a cryptosystem, such as RSA, by measuring the time that is required to encrypt several inputs. To investigate potential consequences, several popular web services were analyzed (email applications, social networks, financial websites) and the research revealed that these new attacks can be exploited in every service, posing an imminent threat to our online security and privacy. The speaker will demonstrate the harmful consequences by discussing several real-world scenarios.

Language
English

Info
Presentation

Tom Van Goethem is a PhD student at the University of Leuven (Belgium), where he has a (not so secret) love affair with research on security and privacy in the context of the Web. As a result of his security research, Tom exposed fundamental flaws in DDoS protection mechanisms, the security seal ecosystem, and several widely used services and web applications, such as WordPress.

Tom Van Goethem

Fingerprinting and Attacking a Healthcare Infrastructure

Author: Anirudh Duggal

There has been a recent spike in the number of attacks on healthcare intuitions, the most serious being the ransomware attacks. The attacks go beyond phishing victims and shutting down the entire infrastructure. The speaker will focus on how to fingerprint hospitals and healthcare institutions and how to defend a system against such attacks.

Language
English

Info
Presentation

Anirudh Duggal is a cybersecurity enthusiast who works at Philips Healthcare on securing medical devices, mobile apps, hardened systems, web services, and healthcare infrastructure. He previously worked at Infosys in the cloud security department. Founded a website on security challenges in the healthcare industry (hospitalsecurityproject.com). Presented solutions and systems at Microsoft Imagine Cup as a national finalist. Took an active part in Null and SecurityXploded. Speaker at Cocon, HITCON, Ground Zero and the forthcoming Nullcon 2016.

Anirudh Duggal

SDR and Others of That Ilk

Authors: Artur Garipov and Pavel Novikov

The hands-on lab is built around wireless technologies. The participants will find out how to intercept and analyze data transmitted wirelessly using SDR (software-defined radio) and other devices. Please bring your own SDR.

Language
Russian

Artur Garipov and Pavel Novikov

Industrial System Security: It's Time to Take Action

Moderator: Ivan Melekhin

It is well proved by notorious incidents that cyber threats to industrial systems are as relevant as ever. Facilitated by Industry 4.0, integration with industrial processes makes cyber systems more vulnerable and exposed to attacks. The modern concept of manufacturing development implies new transparency requirements, horizontal and vertical integration of all industrial control elements within one or several enterprises. Only strong protection can guarantee a desired level of IT penetration.
Industrial security is one of the most difficult sectors to implement security solutions because of restrictions driven by the continuity of technological processes, possible attacks on information and physical objects, prohibited interference with technological processes, and specific equipment. Yet, there are solutions to this problem. While existing technologies are adjusted, new solutions, technologies, and products are elaborated and tested onsite. Our guests from leading manufacturing companies and automated information system developers will share their experience while discussing industrial system security.

Language
Russian

SSDL: One Day in the Life of a Developer

Dev

Author: Valery Boronin

Source code analysis at an implementation phase of an SDL/SSDL: how to make the process easier for a developer? How to implement analysis tools in a way that minimizes resources needed to fix errors? In some cases, the best decision is not to use a user interface. Attendees will watch Man—Machine interaction via source code.

Language
Russian

Info
Presentation

An expert in secure development at Positive Technologies, the head of the Research and Development center in Novosibirsk. Created the R&D center for Kaspersky Lab in Novosibirsk, where he promoted new areas: DLP, encryption, and incident management. Has more than 20 years of experience in software development. Participated in Russian and foreign conferences (DLP Russia). He is the author of many articles and a course devoted to information security and IT management.

Valery Boronin

Realization of Self-Learning Techniques in WAF

Author: Vladimir Lepikhin

This fast track tutorial will focus on the benefits and drawbacks of a statistical-based approach for intrusion detection in web applications compared to signature-based systems. Attendees will learn whether this technique can eliminate false positives that are typical of signature-based threat detection.

Language
Russian

Vladimir coordinates network security matters at the training center Informzaschita. Participated in the production of many training courses. He specializes in security analysis and the detection of network attacks. Contributes to the development of authorized training programs on Positive Technologies products. Regularly speaks at information security forums.

Vladimir Lepikhin

How to Start an Information Security Business

Author: Alexander Bondarenko

The speaker will introduce a short story of creating an IS company from the ground up, based in Russia, aimed at the international market.

Language
Russian

Info
Presentation

The head and founder of R-Vision.

Alexander Bondarenko

Application security? Firewall it!

Author: Eldar Beybutov

Language
Russian

Info
Presentation

Eldar Beybutov

SIEM, or not SIEM, That is the Question

Moderator: Alexey Lukatsky

What tasks can be solved by a SIEM system and what does it actually do? Is there a future for this type of systems? The real state of things in the SIEM segment both in Russia and abroad, and difficulties surrounding SIEM employment.

Language
Russian

Flash is Dead. Flash Forever!

Author: Alexandra Svatikova

Participants will learn about critical security vulnerabilities in Odnoklassniki resulting from three errors in Flash applications and how these vulnerabilities were fixed.

Language
Russian

Info
Presentation

An application security expert at OK.ru.

Alexandra Svatikova

Another Round of the Standoff: IS Services as a Response to New Threats and Challenges

Information security measures more and more often include employment of services from specialized vendors. What threats require prompt involvement of experts? How do IS services work and what are the advantages of the combination of cutting-edge technological solutions and deep expertise? Leading companies in the industry and users of their services will discuss these issues during the round-table talk.

Language
Russian

Lightning Talk

Moderator: Andrey Petukhov and Evgeny Minkovsky

Attendees will have an opportunity to tell briefly about their research, about a new vulnerability or a problem in security algorithms, to speak on a new concept for a security analysis tool or a plan to conduct a large-scale study. Share your ideas and find people who think the same.

Language
Russian

Static Code Analysis in the SSDL Context

Author: Ivan Yolkin

The fast track talk will present successful cases of implementation of Static Analysis Security Tool for QIWI and the difficulties that developers have faced. Whether to use a duct tape or code refactoring? A customer and a developer: what to do when opinions differ? The speaker shares his experience and tells how many lines of code he had to read and write before running the scanner. He will also provide an overview of vulnerabilities that were discovered and missed.

Language
Russian

Info
Presentation

An application security expert at QIWI, a web and mobile technologies researcher, and a full-stack developer who prefers to keep the code pure, comprehensible, and secure.

Ivan Yolkin

Machine Learning Technique to Detect Generated Domain Names

Author: Alexander Kolokoltsev

This talk focuses on the machine learning techniques used to detect domain names generated by the domain generation algorithm (DGA). For solution, an n-gram analysis is suggested. The speaker will describe in detail a domain name analyzer that has 98.5% accuracy.

Language
Russian

Info
Presentation

Alexander Kolokoltsev, a specialist at Positive Research Center, specializes in the development of attack detection techniques. He is engaged in applying machine learning algorithms to DGA detection and developing malware classification based on the behavior analysis.

Alexander Kolokoltsev

How to Exploit Certifi-Gate, in Theory and Practice