Abstract:
IoT and embedded systems are gaining more and more traction in the real world. Low cost of development, availability of simple SoC systems and boards has led to the fame of “”smart things””, where there is an idea that everything, from a toilet to a toaster should have GNU/Linux installed with internet connectivity. Well, this just makes it more fun to hack…

This talk will show a couple of tricks for hacking IoT and embedded systems.

Bio:
Tonimir Kisasondi (@kisasondi) is the head of the open systems and security laboratory at the Faculty of organization and informatics in Varazdin, Croatia, where he works since 2008. He currently likes to improve systems, usually by breaking them. He authored multiple papers, frequently lectures on regional scientific and professional conferences.

Vlatko Kosturjak is security consultant at Diverto where he helps clients to reach desired security level(s). He likes to break and build depending on the mood and time of day(night). Beside security, his passion is open and free software, so he contributed code to various free security software.

Video/recordings:

[Slides] [Recording (MP4)] [Recording (OGV)]

Abstract:
We all use SSH on a more or less daily basis. More advanced users even have created a config file for their clients in order to spare some typos. So let us take you on a journey into the more “”peculiar”” features of SSH. From multi-factor authentication to jump hosts all the way to GPG and the use of SmartCards. Let us show you what SSH can do, if you invest some into configuring it.

Bio:
@maclemon: Sysadmin by trade, strong supporter of anonymity and privacy, that odd person doing strange things with Macs, Hackspace and community affiliations: Metalab; Chaos Computer Club Wien; BSidesVienna, Cocoaheads. Blog URL: https://maclemon.at/

@leyrer: Providing IT-Wizardry for money for over 20 years. Boldly managing systems where angels fear to tread. Easily distracted by everything shiny and blinky. Hackspace and community affiliations: Metalab; Chaos Computer Club Wien; BSidesVienna.

Abstract:
On one hand we have a very strict view bound by the formal legal constraints. These define legal and illegal activities but often miss out on the gray area that is always present. How much hacking is OK before we cross the line? The term “”ethical hacking”” wishes to distinguish the good side of the force that helps vendors and administrators in identifying bugs and vulnerabilities, disclose those to proper entities and this ensure that the world becomes a better place. Responsible disclosure (RD) is a de-facto norm on the internet.

But what terms and processes do we need to define first in order to talk about RD? Are there legal prerequisites before we can shout it out, especially to the media?

Bio:
Gorazd Božič is the Head of the Slovenian national Computer Emergency Response Team (SI-CERT) which was established in 1995. Between 2000 and 2008 Gorazd was the Chairman of the European CERT group TF-CSIRT, which brings together all known CERTs in the wider European region and provides the accreditation and certification programme for CERTS – the Trusted Introducer. Gorazd is involved in national awareness-raising programmes for cyber security and has been the Slovenian representative to the the Management Board of ENISA, the European Network and Information Security Agency, since its formation in 2004.

Video/recordings:

[Slides (PDF)] [Recording (MP4)] [Recording (OGV)]

Abstract:
The Open Web Application Security Project (OWASP) is a known worldwide open source project focused on improving the security of software. It’s mission is to make software security visible, so that individuals and organizations are able to make informed decisions. This session will discuss about OWASP and Mozilla Open Security Overview, the complete approach of Web Application Security when developing or deploying web applications, why security should be considered when developing or deploying web applications, Details information about “”Observatory by Mozilla“” whcich is a open project designed to help developers, system administrators, and security professionals configure their sites safely and securely.
The bug bounty scenario at Mozilla and points everyone to some good open source web application security resources.

Bio:
Shah Mijanur Rahman about himself

I am a passionate independent security researcher and is currently pursuing B.Sc. degree in Computer Science & Engineering in Leading University. I am also a Mozilla Reps and Mozilla Tech Speaker with a passion in speaking, making, fuzzing and teaching. I do Bug verification and fuzzing with Mozilla Enterprise Information Security Team. I have volunteered for various international NGOs in Asia and contributing to various FOSS communities. I love the open web, online privacy & security and new technologies around it and believe in the mission to ensure the Internet is a global public resource, open and accessible to all.

Abstract:
This talk is intended for people that are interested in automatic binary analysis and want to get started with it. Getting into automated binary analysis seems daunting at first due the lack of clear starting points and the complexity of the underlying techniques. Also there are various frameworks which all seem similar but have some subtle differences on closer inspection. The whitepaper and talks are often hard to find and understand, or are simply outdated and don’t represent the current state of the project anymore.

We will start with short introduction to the Z3 theoreom prover, specifically its constraint solver that is used in some form by most frameworks and how to manually use it for simple crackme-like tasks to show some of it’s more capabilities that are useful for reverse engineering.

Then we will generally look at the concept of symbolic execution and how it can be combined with constraint solvers for modelling the possible states of a program.

After a quick overview of the popular analysis frameworks(angr, Triton, miasm and others) and some of their differences we will walk through some example challenges with angr.
The focus here will be not on showing that they can be solved with 20 lines of Python that contain the string “”angr”” a lot but on how specifically angr is used to for various kinds of typical reverse engineering tasks. ”

Bio:
Florian Magin is a security researcher at ERNW Research GmbH. His main interests are reverse engineering and automated security analysis of binary applications. In his free time he is active in the local CCC Erfa and one of the people organizing the CTF team “WizardsOfDos”

Video/recordings:

[Slides (PDF)] [Recording (MP4)] [Recording (OGV)]