Registry keys, hidden processes, known strings and other indicators residing in memory can all help with the early identification of malware infections, especially fileless varieties. This talk will look at how relevant structures are stored in memory, along with a high level look at Windows memory management and a discussion of the pros/cons of some possible methods for searching RAM.

60 mins

Lecture Theatre 1 (2516)

About Peter Cowman

Final year Ethical Hacking student at Abertay University. Interested in malware and memory analysis.

Client-side JavaScript frameworks bring a lot of functionality and logic to the front-end. With all this code running in the browser, do they impose extra risks to the applications? Frameworks like AngularJS incorporate many security features like context-aware encoding and CSRF protection, but they also leave gaps and traps in which developers may fall when putting too much trust into client side code. In this presentation we will look at the security controls provided by the AngularJS framework out of the box and the security defects that still reside in the Angular code and available plugins. Attendees will see demonstrations of several attacks, such as a DOM-XSS, a template injection, and a sandbox bypass.

60 mins

Lecture Theatre 2 (2517)

About Ksenia Dmitrieva-Peguero

Ksenia Dmitrieva-Peguero is a Principal Consultant at Cigital with seven years of experience in application security and five years of software development experience. She performed numerous penetration tests, code reviews, and architecture analysis engagements for clients in financial services, entertainment, telecommunications, energy, and enterprise security industries. Her current concentration is on analyzing JavaScript frameworks and HTML5 technologies, researching their security implications, vulnerability discovery and remediation. Ms. Dmitrieva-Peguero has delivered presentations and trainings at conferences around the world, including BSides Security in London, Nullcon in India, AppSec California in the USA, RSA Asia Pacific & Japan in Singapore, and AppSec Europe in Italy.

Ksenia holds a M.S. in Computer Science and is currently pursuing her Ph.D. at George Washington University.

We hear about advancements in the offensive security realm all the time, with new attack techniques being published, new tools released and high profile breaches of major organisations reported in the news. With a whole bunch of technical certifications, training and frameworks available, the offensive security industry is very well represented and fairly well understood, at least in comparison to defensive security. But what do these attacks actually look like, how can we defend against them, and what techniques are there for detecting them?

In this talk, we’ll explain some of the technical concepts of threat hunting. We will be looking at what is beyond traditional signature detection – the likes of AV, IPS/IDS and SIEMs, which in our experience are ineffective – and detailing some of the ways you can catch real attackers in the act. As a case study, we’ll look at some of the specifics of common attack frameworks - the likes of Metasploit and Powershell Empire - walking through an example attack, and showing how they can be detected. From large-scale process monitoring to live memory analysis and anomaly detection techniques, we will cover some of the technical quirks when it comes to effective attack detection.

60 mins

Lecture Theatre 1 (2516)

About William Burgess & Matt Watkins

This presentation will be given by myself and a colleague, Matt Watkins, from Countercept, MWR Info Security. Our interests are in the nitty gritty of Windows Internals, detecting bad guys, memory forensics and threat hunting, and this talk will outline our experiences of doing this at scale.

Security researchers focus a lot on the Internet of Things and the vulnerabilities that exist within it, and rightly so! In this talk, I'll use my experience as the main technical contact for a UK smart plug manufacturer to try and share an insight of how we're trying to fix things in the industry from the other side of the coin. I'll also cover major IoT vulnerabilities, their key learnings points, and how some big players enforce security for companies that use their platform.

60 mins

Lecture Theatre 2 (2517)

About Jamie Hoyle

I'm a software developer from Manchester who specialises in building software for connected devices. I'm currently working as a software consultant for a UK-based Internet of Things company, as well as building a transportation startup. Aside from technology, I watch Bury FC lose every week and run around forests with a map for fun.

With the rise of sandboxes and locked down user accounts attackers are increasingly resorting to attacking kernel mode code to gain full access to compromised systems. This talk aims to provide an overview of the Windows kernel mode attack surface and how to interact with it. This talk will demonstrate the tools available for finding bugs in Windows kernel mode code and drivers together with highlighting some of the lower hanging fruit, common mistakes and the steps being taken (or lack of steps being taken) to mitigate the risks posed. The talk will then cover common exploitation techniques to gather information about the state of kernel mode memory and to gain code execution as SYSTEM using examples from publicly known exploits.

60 mins

Lecture Theatre 1 (2516)

About Sam Brown

Sam is a consultant at MWR interested in reverse engineering, software security and general low-level weirdness.

The statistics about ransomware show that payments continue to be made, that all sorts of business verticals continue to fall victim to this malware and that there is very little in the way of prevention which appears to be working. In this talk I will look at the factors (encryption, phishing, user fallibility, immediacy) that have contributed to ransomware being a successful vector, what the industry has done and should be doing to ensure that people do not fall victim anymore, and how if nothing more is done, this will be a "battle we will not win".

60 mins

Lecture Theatre 2 (2517)

About Dan Raywood

Contributing Editor of Infosecurity Magazine, I've been writing about IT security for over 8 years and have presented at 44CON, Infosecurity Europe and SC Congress. Enjoy (almost) all areas of security, and craft beer and Spurs outside of the day job.

About Rafe Pilling

Rafe Pilling is a Sr. Security Researcher working in the SecureWorks Counter Threat Unit (CTU). He has extensive experience in threat intelligence research, malware analysis, penetration testing, DFIR, SOC operations and compliance from over a decade of delivering pragmatic security solutions and advice to clients. His current role in the CTU focuses on tracking EMEA focused threat groups, developing intelligence based countermeasures to protect client networks and investigating complex incidents.