In ShellCon 101 I will explain industry terminology and discuss key aspects of the conference. I am a 17 year old who has been volunteering for ShellCon since the beginning and I want to help newcomers get the most out of the conference and have the full experience. Last year I knew the keynote was really funny but the vocabulary went right over my head. I will go into detail about the Hacker Village, RaiseMe, talks, the layout of the conference, and things to do in downtown San Pedro.

As a security practitioner, the trend of Agile and DevSecOps is coming. Whether developers or management are pushing for it, you should be prepared. DevSecOps sets security as a metric of success for developers and encourages security to be a consideration continually through a project lifecycle. This is a vast improvement to the usual methods of taking security into consideration only at the end, in the beginning, or avoiding talking to security at all. You should be seizing the opportunity to leverage the movement to your advantage. I want to arm you with ideas on education, resources, tools, and practices to do DevSecOps well from a Security department standpoint.

Red Team operations require substantial efforts to both create implants and a resilient C2 infrastructure. SiestaTime aims to merge these ideas into a tool with an easy-to-use GUI, which facilitates implant and infrastructure automation alongside its actors reporting.

SiestaTime allows operators to provide registrar, SaaS and VPS credentials in order to deploy a resilient and ready to use Red Team infrastructure. The generated implants will blend-in as legitimate traffic by communicating to the infrastructure using SaaS channels and/or common network methods.

Use your VPS/Domains battery to deploy staging servers and inject your favorite shellcode for interactive sessions, clone sites and hide your implants ready to be downloaded, deploy more redirectors if needed. All this jobs/interactions will be saved and reported to help the team members with documentation process.

SiestaTime is built entirely in Golang, with the ability to generate Implants for multiple platforms, interact with different OS resources, and perform... Read More

2019 is a hell of a year. Why not make it worse by coming and hearing from one of the world’s foremost experts on mainframe hacking? ‘Hmm’, you’re thinking, ‘mainframes who cares?’ If you’re using any type of credit card (yes even Apple Pay) you care. It is the most important piece of equipment in any enterprise. So how come you still think they’re unhackable?. This talk will go over SNA hacking, VTAM, TSO, CICS, privesc, REXX, and CLISTs, walking through the various techniques successfully used on pentests. Introducing new tools to help conduct penetration tests. You will see how easy it is to get started with mainframe hacking and all the tools currently available today.

Airplane hacks can ground one flight, mainframe hacking can ground the fleet.

Developers often do not know what the common issues are with the framework they are using. At the same time, most common frameworks ship with easy ways to shoot your application’s security in the foot. In this world we live in, developer education will fail if even one mistake is made, which will expose a dangerous vulnerability. In this talk, we’ll show how you can dramatically reduce the chance developers will shoot themselves in the foot by giving them safer versions of their common tools so your company can ship more secure code. We will write wrapper classes and safe versions of common tools to eliminate XSS vectors, open redirects, XXE, SSRF, LFI, and other dangerous bugs in your codebase.

MacOS is a popular operating system across Startups and Fortune 500 companies. Few commercial tools exist that provide proper event visibility in MacOS. Often, these tools are expensive and some lack important monitoring features. However, open source offers a great selection of tools that can be deployed to kick start a MacOS Threat Hunting Program. In this talk, I will simplify threat hunting, select a few open source tools, and guide the audience on a methodology to hunt for threats in MacOS.

Every day we hear about weak security of IoT devices, about vendors that don’t take security seriously and how using and not changing default passwords could lead to a leak of important and personal data. GPS trackers made with a default password and predictable serial numbers allow full control of the tracker and leak the user’s position. Due to heavy white labeling and use of the same cloud infrastructure the scale of the problem is huge. I’m going to show and discuss where the weaknesses are, what models and APIs are affected and how they can be exploited. Live demo included. The talk is by itself also a comprehensive guide on analyzing IoT device security, spanning from Android app to HW.

PErfidious is a Python3 tool that aims to directly take a benign PE executable and malicious shellcode, transform the malicious shellcode and inject the transformed shellcode directly into various parts of the executable’s .text section, thus completely avoiding the need to look for code-caves or creating additional sections. After injection, PErfidious recalculates the size of the .text section and all the virtual address changes caused by the increase in the size of the .text section and modifies respective fields in the PE header, thus making sure that the PE file doesn’t look injected.

Competitions are everywhere in cyber security, but have you ever wondered what it takes to create one? This talk covers the challenges of creating an exciting competition that helps people develop skills and covers the challenges faced in building infrastructure to support competitions. We will primarily be covering CCDC competitions (Collegiate Cyber Defense Competitions) but we will also cover capture the flag competitions through the lens of a competition organizer and the challenges faced. If you are interested in competing in or want to help put together an competition, this talk is for you.

Software developers are the foundation of any application. In order to achieve secure software, developers must be supported and helped by the organization they author code for. As software developers author code that makes up a web application, they need to embrace and practice a wide variety of secure coding techniques. The OWASP Top Ten Proactive Controls (2018) is an OWASP documentation project that lists critical security techniques that should be included in every software development project. This document was written by developers for developers to assist those new to secure development.

Since the 2014 Sony Pictures hack, studios and post production houses all over Hollywood have been the target of attacks. In 2017, a hacker targeted and successfully compromised Larson Studios, a family-owned post-production house, exfiltrating “Orange is the New Black” Season 5. The attacker demanded ransom to keep the content from being uploaded to The Pirate Bay.

This talk will give a behind the scenes view of the film making process from a content security and blue team defensive perspective. Learn the digital workflow that goes into making the blockbuster films you love and where the industry is vulnerable to attack. Hear campfire stories from one of 30 MPAA Certified Trusted Partner Network Assessors worldwide.

This talk will go over a new tool I’m releasing, NAT Pinning v2. NAT Pinning allows an attacker to remotely access any TCP/UDP services bound on a victim machine, bypassing the victim’s NAT/firewall (arbitrary firewall pinhole control), just by the victim visiting a website. It uses multiple techniques to be cross-platform, cross-browser, and multi-protocol. Some areas we’ll cover:

• NAT (Network Address Translation)
• Router Investigation
• Firmware Dumping
• Reverse Engineering Firmware
• Network Protocol Investigation
• Browser Protocols
• Timing Attacks

Xamarin allows developers to create mobile applications for both iOS and Android using C#. The managed code is compiled into the app and later executed by the mono runtime once started. Hooking the C# methods can be challenging, especially early in the start process when trying to bypass root or jailbreak detection. This talk will demonstrate a methodology that can be used for early C# method hooking of Xamarin release builds on both iOS and Android.

We all know that encryption is a critical component to modern security, but it’s not enough to sprinkle encryption on you data as if it’s magic pixie dust. Sometimes we take the finer points for granted. In this talk we’ll cover the history of encryption in broad strokes. Then we’ll dig into some basic concepts: What’s the difference between encrypting and encoding data, or is the difference only semantics? Can obfuscation be considered a type of encryption? What’s the difference between transposition and substitution ciphers? Between stream and block ciphers? What’s a cipher?!? Is TLS/SSL symmetric or asymmetric? (hint: it’s both). We’ll conclude with some practical discussion, such as what can I use in my project?

With how many apps are running in the cloud, hacking these instances becomes easier with a simple vulnerability due to an unsanitized user input. In this talk, we’ll discuss a number of different methods that helped us exfil data from different applications using Server-Side Request Forgery (SSRF). Using these methods, we were able to hack some of the major transportation, hospitality, and social media companies and make $50,000 in rewards in 3 months.

Application security reviews are big part of Application Security Programs. It’s an important topic for all organizations, especially for those with externally facing websites or/and APIs. I perform security reviews of 3rd party software we use and custom built applications. In this talk I will focus on an organization’s custom built application security review.

As users move to the world of Mobile Apps, it becomes important to understand the security and privacy risks around Mobile Apps. This session will delve into security and privacy issues like secure mobile app development, third party SDK security, cryptographic storage, IP protection among others.

Remediation is a crucial step when recovering from an incident. Proactively implementing security controls and hardening an environment doesn’t need to wait until AFTER an incident has occurred. The presenter will detail common remediation strategies that are used when responding to breaches, in addition to risk-reduction methods that align to proactively applying a remediation strategy.

Many companies use commercial static analysis tools (SAST) to find bugs, but these SAST tools tend to be expensive, have high false positive rates, and are difficult to customize. “Lightweight” static analysis tools hit a sweet spot that is more powerful than grep but still simple enough that you can write your own.

In this talk, we’ll describe how to create your own lightweight static analysis scripts using open source libraries and tools. These techniques can be used by penetration testers to more effectively find bugs and/or integrated into CI/CD checks by security engineers to raise the security bar of the applications they support.

On the ground (e.g. during Non-Technical OS-INT), many unforseen small conflicts may arise. The ability to think on your feet paired with an ability to read people’s basic statistical probabilities and a sense of charisma can make the difference between exiting the conflict unscathed and tanking the excursion.

The ability to follow the same basic skeleton of social engineering procedures helps shape one’s ability to assess a conflict, identify goals, assess resources available based on general statistical knowledge, plan, and launch an attack that will neutralize the conflict while protecting the asset/target/bystander.

Discusses basic tenets of certain aspects of psychology, sociology, anthropology, etc., to pull together strategies to assess, formulate, and launch on the fly as the situation demands.

Also makes fun time-killer when out on the town.