A warm welcome to Community Event, a free event open for anyone over 18 with lots of breaks to mingle and maybe grab a drink.

  /$$$$$$  /$$$$$$$$  /$$$$$$  /$$$$$$$$
 /$$__  $$| $$_____/ /$$__  $$|__  $$__/
| $$  \__/| $$      | $$  \__/   | $$   
|  $$$$$$ | $$$$$   | $$ /$$$$$$ | $$   
 \____  $$| $$__/   | $$|______/ | $$   
 /$$  \ $$| $$      | $$    $$   | $$   
|  $$$$$$/| $$$$$$$$|  $$$$$$/   | $$   
 \______/ |________/ \______/    |__/                 

OSINT gathering is trying to lock on a moving target in an ever-changing landscape. This talk provides a deep dive into today's tools, best practices, counter-measures and common mistakes. Drawing on three years of continuously developing and improving an OSINT-gathering environment in private security, intelligence analyst (or "bad guy hunter" for the movie credits) Elin shares war stories on manipulating big tech, trying to out-compete the spammers and the scammers and interacting with some really Crazy People Online

The Tillitis TKey security device uses a novel way of helping
guarantee hardware supply chain security to the end-user. During the
end-phase of production we run a device app, where the TKey
automatically creates a unique identity inspired by TCG DICE and then
sign and publish data about this identity. The identity and the
signature can be independently verified at any time by a user to help
verify that the TKey hasn't been tampered with.

In this talk I will go through how this verification works, introduce
the concepts behind both the TKey measurement and the verification as
well as as the actual security protocol we follow. I will also explain
why I think this can be useful for other products.

AS/400 - also known as IBM i - has been around since 1988 and is still alive and kicking in many organizations today. In this talk I will recap on known AS/400 hacking techniques and go through a few interesting findings from around 8 security assessments I worked on over the last 10 years that included AS/400 systems. I will cover the network attack surface of an AS/400 system, local privilege escalation and post-exploitation vectors, and demonstrating some novel techniques derived from my own research along the way.

Blessed sanctum, save us.

In this talk, I will present Sanctum, a new, fully privilege-separated, compact and performant VPN daemon for POSIX systems.

Sanctum is based on the principle of "least privilege" using a multi-process approach where each process only has the necessary permissions to perform its function. This completely separates encryption, decryption and io paths from each other in a way not done before in VPN software.

Also, what happens if you do things wrong? Winky face.

So put on your hacker hat, and let’s hack.

Electronic Identification solutions are everywhere, more and more are popping up after the EUs eIDAS regulation that attempts to achieve a secure way to digitally authenticate individuals. Often these systems are implicitly trusted, however time after time vulnerabilities have been discovered in them, making them very valuable targets for threat actors. The Swedish BankID is a popular eID solution, in this talk I will go over a technical and security overview as well as presenting vulnerabilities found in the most common implementations.

A warm welcome and introduction talk about SEC-T by the SEC-T organizers.

   _____ ______ _____   _______ 
  / ____|  ____/ ____| |__   __|
 | (___ | |__ | |   ______| |   
  \___ \|  __|| |  |______| |   
  ____) | |___| |____     | |   
 |_____/|______\_____|    |_|                             

Robert Sell has been a certified human tracker in his capacity as a Team Leader in Search and Rescue for over a decade. Trained by border services tracking teams and Canadian Special forces, Robert has spent countless hours as a three person tracking team searching for real persons in the Pacific North West. He applies the tracker skillsets to help people improve their Open Source Intelligence Operations. As the Founder of Trace Labs he has had the opportunity to see the OSINT strategy and techniques of thousands of investigators. He uses this knowledge to compare and show best practises from the tracking field to help OSINT investigators. Robert lowers the curtain on the skillsets and approach real trackers take. This includes everything from detecting state of mind to sign cutting concepts. This talk will allow you to see what was previously invisible to you.

SEC-T 0x10sion Music Synthesizer Badge kit

You can buy the kit at the SEC-T shop.

Anyone can learn to solder! And anyone can learn to make music, sound
(and noise!) with computer chips! All participants will easily learn
all of this by making their SEC-T Music Synthesizer Badge from the open
hardware kit. This workshop is for everyone -- even total beginners.

Code: https://github.com/SEC-T/badge-2024

A comparison between conventional and supply chain attack patterns in Java.

In this talk, we introduce new Java post-exploitation tools while exploring the possibilities and challenges in performing dropping, command & control, persistence, privilege escalation, secret stealing, and lateral movement inside a Java environment.

This talk compares the steps of conventional RCE exploitation in Java with supply chain-based attacks. Using a combination of known but underutilized attack techniques, the living off the Java land attack path challenges assumptions about how attackers may behave after gaining a foothold in a Java process to avoid detection. This talk also explains detection points that a defender can monitor to increase their threat detection capabilities.

Since the end of 2022, we have identified multiple espionage-related intrusions targeting governmental entities in the Middle East Africa and Asia. According to our findings, the main goal of the attacks was to obtain highly confidential and sensitive information, specifically related to politicians, geopolitical events, military activities, and ministries of foreign affairs.

The threat actor behind the attacks used a very rare set of tactics, techniques, and procedures (TTPs), which sets it apart from other known threat actors. Some of TTPs were never reported before in the wild, such as a novel and evasive in-memory webshell implant and custom-built family of backdoors. Other rare techniques that we observed included a novel Exchange email exfiltration technique that was used by the attackers only on a few selected targets, and a credential stealing technique that was rarely seen in the wild.

In our presentation, we will explore the TTPs employed by the sophisticated threat actor throughout each phase of the attack life cycle and share some exclusive information that has not been published yet about the attackers’ playbook. After understanding how this threat actor operates, what exactly they were looking for, and how to hunt them down, we will delve into the attribution process and establish the connection to the Chinese Nexus through different facets.

The topic of attacks on access badges is widely discussed, but what can an adversary do when cloning someone’s card isn't an option? How else can one gain entry into high-security areas without direct access to the credentials?
In this talk, I will discuss techniques for compromising RFID readers to bypass organizational security mechanisms. We will cover:
- how to intercept the communication between the reader and the controller that are using the Wiegand protocol, along with the demo of this attack;
- how to use this entry point to leverage access through different attacks;
- how the OSDP protocol works and what are the security implications of using it;
- what are the other ways to bypass the access control security mechanisms.
I will also share real-world experiences and stories from Red Team engagements, demonstrating practical applications of these techniques in real-life scenarios – hopefully without getting caught ;)

What happens when a rarely seen piece of malware, attributed to one of the world’s most elite APT groups, reemerges in the midst of the “cyber battlefield” of the Ukraine - Russia conflict? We will explore the evolution of the advanced Kazuar backdoor by the elite Turla APT group. We will dive into Kazuar’s technical analysis and Secops, going into detailed analysis of its previously undocumented functionality, encryption implementations, packing and code obfuscation. We will provide the audience with practical ways to hunt for the elusive Kazuar backdoor.

Even total newbies can learn to make way cool electronic projects with
Arduino. It’s fun and easy. Itinerary: Intro to Arduino, Everything
about Electronics, Learn to Solder, free Arduino software, Program
Arduinos, Read schematics, Make a TV-B-Gone on a Solderless Breadboard,
Target Practice.

  ▄████████    ▄████████  ▄████████     ███     
  ███    ███   ███    ███ ███    ███ ▀█████████▄ 
  ███    █▀    ███    █▀  ███    █▀     ▀███▀▀██ 
  ███         ▄███▄▄▄     ███            ███   ▀ 
▀███████████ ▀▀███▀▀▀     ███            ███     
         ███   ███    █▄  ███    █▄      ███     
   ▄█    ███   ███    ███ ███    ███     ███     
 ▄████████▀    ██████████ ████████▀     ▄████▀   

As backwards compatibility is a key element in Windows, some known issues stay unfixed. We encountered such an issue when we ended a file name with a dot using NT API. Surprisingly, we couldn't delete, write or rename it. Then, we created a similarly named file without the dot, and like magic, operations on the first file, affected the new file.

We set a goal to reverse engineer this magic and create greater magic tricks. We then realized that trailing dots and spaces are removed when Windows converts normal (DOS) paths to NT paths.

This was a perfect primitive for new magic tricks. Without any control over API or system calls, we managed to hide files and processes, hide files in archives, completely disable ProcExp with a DoS vulnerability, affect prefetch file analysis to report false information, and even make Task Manager and ProcExp users think a malware is a verified executable published by Microsoft. We had rootkit-like abilities as unprivileged users.

Furthermore, we found an RCE vulnerability in Windows' new extraction logic for RAR, 7ZIP, TAR, and more! We also found two more vulnerabilities that allowed us to escalate both deletion and writing privileges.

In this talk, we'll present MagicDot - A set of vulnerabilities and unprivileged rootkit techniques that are all possible thanks to disappearing dots and spaces. A full attack chain starting from remote code execution, to concealments, and privilege escalation. In this magic show you'll also learn the tricks.

The Apache HTTP Server is comprised of dozens of different modules, which are coupled together. While delving into the source by chance, we discovered that the coding style seemed a little bit... open? When a new HTTP request arrives, all modules uphold and maintain a colossal structure, collaborating in harmony to complete the request. While this cooperation might sound ideal, the reality reveals a significant challenge: the modules are not entirely familiar with each other, especially regarding the implementation details. However, they are asked to collaborate to fulfill the task. If any module has an incorrect understanding of any fields of this huge structure, it could potentially lead to fatal issues.

This observation led us to focus on interactions between modules, and discover this new attack surface. Let's see how a seemingly harmless structure modification can be passed through layers, amplifying the impact and affecting other modules to become vulnerabilities. This novel attack surface unearthed 3 distinct types of Confusion Attacks and 8 vulnerabilities, which allow us to navigate easily between Httpd modules, generating various attacks based on the different functionalities of modules: from the simplest arbitrary source code disclosure to bypassing ACL, and enabling unlimited SSRF. Of course, we won't forget about RCE, we will demonstrate how a long-underestimated bug type can be transformed into code execution by leveraging Httpd's internal features!

The marketing for new technologies like Intel TDX and AMD SEV-SNP claims that we can finally run VMs without trusting the underlying infrastructure. All the big cloud providers are praising them and how they will protect our ("highly valued") privacy, but isn't this just snake-oil to make us comfortable handing over all our precious data?

In this talk, the presenter will refrain from buzzwords and attempt to explain how confidential computing actually works, what is required to properly use it and set realistic expectations on this emerging technology.

During SEC-T each year we take one hour out of the schedule to allow lightning speakers to do brief presentations on stage.

• Nicklas Keijser: Dissecting the Cicada
• klondike: PaTo: secure storage of passwords on the client side
• Joakim Persson & Lars Otterskog: How to con a conman

Welcome to Club SEC-T!

This is the official party for the SEC-T information security / hacker conference on Thursday night. To make this as much fun as possible, it's free to attend even if you don't have a conference ticket, and no registration is required either - simply drop in if you're 18 years or older 🙂

We present Instant Remedy live on stage for the second time ever, the video game music and remix artist that inspired the founding of Syntax Error over 20 years ago!

To support him we have DJs from Syntax Error as usual and FUZZY?CATS delivering big beat-inspired throwbacks to the late 90:s intertvined with modern takes and visuals.

You'll also meet Karategamers who're here to help make this a truly pleasant night with a lot of retro games to play.

And there'll be lasers, lots of lasers, 'cause we've also invited Laserboy as per usual!

Prepare for a brand new Cyber Security Quiz by Oskar Duveborn that'll challenge even the most hardened security veterans!

For more information and time table, see the Club SEC-T Facebook event.

There is currently no bigger disruptor in most areas of technology than artificial intelligence (AI). Businesses worldwide seem to be in a rush to adopt and integrate AI technology with the goal of improving their operations and, ultimately, their revenue.
Malicious actors have been doing the same.
But this is not a talk about deepfakes. Granted, deepfakes will eventually start claiming their place in the world of cyber crime and social engineering but if we are realistic, there are some more pressing, newfound capabilities in the here-and-now that cybersecurity professionals will have to defend against.
Artificial intelligence algorithms are already part of the toolkit of cyber criminals. The most popular type being large language models (LLMs) like ChatGPT, and its by-products like FraudGPT and BadGPTs.
What are the observed tactics that cyber criminals follow right now to improve their social engineering attacks and success rates? Are we adequately prepared to defend against these new capabilities and what’s to come?
The presentation will provide insights on how LLMs are currently being exploited by threat actors to research and identify targets, physical security vulnerabilities, supercharge social engineering tactics, and the types of enhancements we have been observing.
We will also discuss some myths. There will be examples as well as demonstrations from our own research.

In theory, theory and practice are the same. In theory, all modern macOS applications must be isolated what is enforced by notarization and sandboxing. In practice these enforcements are usually ineffective. This talk starts by explaining basic isolation assumptions and quickly shifts to exploitation. I have selected a few the most popular macOS password managers written in different technologies to prove how a low-privileged malware can abuse various tricks and 0,n-day vulnerabilities to drain your credentials.

During this talk you will:
- learn how macOS hardened runtime, sandboxing, and TCC app management privilege work
- see 0,n-day vulnerabilities and architectonical problems I have found in popular macOS password managers
- understand why software distributed via websites is sometimes more secure than from the Apple Mac App Store
- see my exploits and a lot of demos

After the talk, the audience should be able to explain macOS isolation mechanisms (in)security, check their password managers for presented vulnerabilities, and effectively support their macOS blue/red teams.

Anyone can learn to solder! And a fun way to do learn is by making
this wonderful little device that encourages you to turn
off TVs in public places! It works on a huge percentage of all TVs in
the world. Airports, bars, schools, waiting rooms… Works from 50 meters
away!

   _____ ______ _____   _______ 
  / ____|  ____/ ____| |__   __|
 | (___ | |__ | |   ______| |   
  \___ \|  __|| |  |______| |   
  ____) | |___| |____     | |   
 |_____/|______\_____|    |_|   

Common Language Infrastructure XML (CLIXML) is a widely used PowerShell serialization format. In this presentation, we will learn how to exploit PowerShell deserialization to move laterally and escalate privileges in an enterprise environment. I will perform multiple live demos, including a guest-to-host virtual machine breakout.

I will present several novel deserialization gadgets to achieve everything from out-of-band network requests and credential stealing to remote code execution. This includes golden gadgets that work on vanilla PowerShell installations and gadgets that depend on widely used PowerShell modules.

Finally, we will discuss how we can protect ourselves against these attacks as IT admins and how to avoid these vulnerabilities as developers.

It’s 2024, and Cloud Security is the same dumpster fire it’s always been. Fifteen years into running our critical workloads on “someone else’s computer,” we’re still making the same mistakes while our adversaries evolve. This talk will dissect several high-profile cloud breaches to discuss where the customer and the cloud providers went wrong. We’ll see how adversaries are changing and how cybercrime and geopolitics have lifted and shifted themselves into the cloud along with our legacy workloads.

With this information, we’ll find the common elements of these major incidents and discuss a universal threat model that applies to everyone in the cloud. Finally, I’ll cover how the cloud providers are letting their customers down and what you can do to protect yourself.

SEC-T 0x10sion Music Synthesizer Badge kit

You can buy the kit at the SEC-T shop.

Anyone can learn to solder! And anyone can learn to make music, sound
(and noise!) with computer chips! All participants will easily learn
all of this by making their SEC-T Music Synthesizer Badge from the open
hardware kit. This workshop is for everyone -- even total beginners.

Code: https://github.com/SEC-T/badge-2024

Malware continues to increase in prevalence and sophistication. VirusTotal reported a daily submission of 2M+ malware samples. Of those 2 million malware daily submissions, over 1 million were unique malware samples. Successfully exploiting networks and systems has become a highly profitable operation for malicious threat actors. Traditional detection mechanisms including antivirus software fail to adequately detect new and varied malware. Artificial Intelligence provides advanced capabilities that can enhance cybersecurity. The purpose of this talk is to deliver a new framework that uses Machine Learning models to analyze malware, produce uniform datasets for additional analysis, and classify malicious samples into malware families. Additionally, this research presents a new Ensemble Classification Facility we developed that leverages several Machine Learning models to enhance malware classification. To our knowledge, this is the first research that utilizes Machine Learning to provide enhanced classification of an entire 200+ gigabyte-malware family corpus consisting of 80K+ unique malware samples and 70+ unique malware families. New, labeled datasets are released to aid in future classification of malware. It is time we leverage the capabilities of Artificial Intelligence and Machine Learning to enhance detection and classification of malware. This talk provides a pathway to incorporate Artificial Intelligence into the automated malware analysis domain.

Did you know that if you change a single bit from 1 to 0 (or vice versa) in the first 'g' of the domain name google.com (which is 01100111 in binary) you will end up with variety of valid "bitflip" domains like coogle.com, oogle.com, & woogle.com

So what happens if you generate and register a bunch of cheap bitfliped versions of popular cloud / Saas provider domains, point them to your VPS, log all incoming requests & then forget about the whole thing for two years?

Well you will in fact receive a stiff bill, generate huge log files and eventually run out of disk space. But on the upside, you will also have collected a treasure trove of legit credentials & interesting stuff like valid OAuth refresh tokens, JWT tokens, bearers, cookies, emails, meeting invites with passwords & truckloads of internet scanner noise.

In this session we will revisit bitflip research from the last decade and weponize it. Showcase 'Certainly' a pioneering offensive / defensive tool that employs Wildcard DNS matching & on-the-fly generated SSL certificates and custom payloads for incoming requests across various protocols. All with the intention to downgrade security, harvest credentials, capture emails and replacing dependencies with custom "malicious" payloads

In this talk, we unveil Einride's journey in creating an advanced vulnerability management program. How we integrated diverse security data into a unified source, streamlined data extraction, and built insightful dashboards. Discover how we empower development teams with actionable insights, focusing on meaningful metrics, and discuss the key components of our success.

From the dawn of computer games cheats have always been present, evolving alongside the developers who sought to protect themselves against them.
We will go over a brief history of cheats throughout the years, from the early days of the built-in cheat codes to the modern day of aimbots and DMA hacks.
We will discuss and show notable cheats and implementations and how they have shaped the gaming industry up to the modern day of EasyAntiCheat and RiotGuard.

Whats better than a 35 dollar a month cheat? A 35 dollar a month info stealer!
After we have a basic understanding of the world we are talking about, the talk will delve into a case we've found where a cheat developer has been both charging his customers for giving him access to all of their information. We will talk about the technical details of analyzing malware, its infrastructure, and the legal implications of this case (which may include some advanced OSINT).

Thanks for this year!

 S)ssss  E)eeeeee   C)ccc          T)tttttt 
S)    ss E)        C)   cc            T)    
 S)ss    E)eeeee  C)                  T)    
     S)  E)       C)       #######    T)    
S)    ss E)        C)   cc            T)    
 S)ssss  E)eeeeee   C)ccc             T)