BSidesChicago 2017 has ended
Track 1 [clear filter]
Saturday, July 15

10:10am CDT

Industrial Control Systems (ICS) - The good, The bad & The ugly
Industrial Control Systems (ICS) - The good, The bad & The ugly. A higher level introduction and overview on the current state of the control systems that run essential infrastructure we depend upon (namely power, water, oil & gas). I will highlight how it typically works, whats wrong (and why) and what we can do to improve things.

avatar for Matt Cowell

Matt Cowell

Director of Product Marketing, Dragos
Matt Cowell has more than 15 years of experience in industrial control systems (ICS) and operational technology (OT) applications with a focus on networks and cyber security. He has specific expertise in industrial automation and SCADA systems often used in critical infrastructure... Read More →

Saturday July 15, 2017 10:10am - 11:00am CDT
Williford A

11:10am CDT

Vulnerability Hunting on Network Devices
Vulnerability hunting on network devices has long been an arcane, occult art-form owing to squamous hardware, strange software, and operating systems that seem to defy both logic and good software development practices. The challenges are great, but the allure of binding such strategically placed devices to your will is strong.  This talk will walk you through building an effective toolset to explore and exploit these network devices, by getting into their very essence, debugging them and using the latest in freely available tools and some very low cost hardware.

avatar for Bobby Kuzma

Bobby Kuzma

Security Researcher and Evangelist, Core Security
Bobby Kuzma is a security geek and retired IT consultant who accidentally acquired a CISSP at the tender age of 22. If it processes data, he’s probably tried to make it do bad things. He teaches, mentors, and explores (and occasionally explodes) technology. Four out of five coworkers... Read More →

Saturday July 15, 2017 11:10am - 12:00pm CDT
Williford A

1:00pm CDT

Between You and Me and the Network Security Boundary
Many organizations have IT environments with zones of varying security requirements. These zones are usually networks that are created to encompass systems that serve different functions, from production web applications to PCI in-scope database servers.

An organization has to make a decision about implementing a security boundary that protects high-security areas from low-security areas. Designing and deploying these solutions can be a complex task, contending with hurdles from compliance requirements and management all the way to just making sure the users can remember how to access all the necessary systems. This complexity leaves many holes that can be exploited by bad guys to get access to the most sensitive data. Most penetration testers will tell you that getting past these barriers, even ones that implement fancy security features such as multi-factor authentication, become bypassable through race conditions and configuration flaws.

This talk will review several common solutions of separating and accessing network zones such as VPNs, bastion hosts, and virtualization along with each solution's most common pitfalls. As we review each implementation, I will talk about both low-hanging and high-hanging fruit in terms of bypass methodologies, while giving real-world examples of leveraging weaknesses such as race conditions and configurations flaws to gain access to secured networks. I will do a deep dive into the architectures that most efficiently secure protected networks such as Microsoft's Privilege Access Workstations (PAWs) as well the management practices that create effective long-term security barriers. 

avatar for Patrick Fussell

Patrick Fussell

Penetration Tester, Payment Software Company, Inc.
In preparation for his transition out of the Marine Corps in 2010 Patrick Fussell had his first exposure to the information security world working with the information assurance department. Over the past six years he has worked in numerous roles to increase the security of IT environments... Read More →

Saturday July 15, 2017 1:00pm - 1:50pm CDT
Williford A

2:00pm CDT

Hackers Interrupted
Going beyond a breach or initial damage, let’s examine the minds of the hackers. What drives them to succeed, what makes them fail? It is a difficult task to understand internal motivations of a hacker, beyond the obvious, and rarely anyone tries. The practical approach shows opposite, understanding hacker’s thinking may lead to a reversal of their ill gains. Using practical examples from the largest breaches of today, we will get inside the hackers’ mind and find out how to stop them.

avatar for Alex Holden

Alex Holden

Hold Security
Alex Holden is the founder and CISO of Hold Security, LLC. Under his leadership, Hold Security played a pivotal role in information security and threat intelligence, becoming one of the most recognizable names in its field. Holden is credited with the discovery of many high-profile... Read More →

Saturday July 15, 2017 2:00pm - 2:50pm CDT
Williford A

3:30pm CDT

Cloudy with a Chance of Persistence: AWS Post Compromise Persistence Techniques
The use of Amazon Cloud as a base of operations for businesses is increasing at a rapid rate. Everyone from 2 person start-ups to major companies have been migrating to the cloud. Because of this migration, cloud vendors have become the focus of potential exploitation and various role abuse in order to achieve persistence. This presentation will cover several different methods of post-infection and account persistence along with a discussion on best practices that can be used to protect from such techniques.


Peter Ewane

Peter Ewane (@eaterofpumpkin) is a security researcher, sometimes speaker, and a mostly blue teamer for the Alien Vault Labs Team. When not playing with computers, Peter enjoys trying and making interesting cocktails and collecting whisk(e)y.

Saturday July 15, 2017 3:30pm - 4:20pm CDT
Williford A

4:30pm CDT

Cashless Society: a Credible Death Threat to Privacy
The idea of a cashless society could be one of the greatest threats to freedom in human history. It carries chilling potential to create an inescapable financial panopticon of monetary surveillance and data collection with unprecedentedly granular resolution. Governments, banks and credit card companies around the world continue to wage war against the ubiquity of cash in a deliberate push towards a future cashless society. In light of its notably incoherent political dynamics, what possible roles might Bitcoin and blockchain technology play in safeguarding social interests in a future without cash? How else might we hedge against the perceived inevitability of this potential dystopian future?

avatar for Skye Elijah

Skye Elijah

Co-founder and CEO, CoinBeyond
Skye Elijah is a financial activist and subversive technologist working on issues relating to the nature of technology, digital ethics and the future of sustainable global finance. A former National Science Foundation Merit Scholar, Skye has a Bachelor of Science degree in Theoretical... Read More →

Saturday July 15, 2017 4:30pm - 5:20pm CDT
Williford A

5:30pm CDT

Sophisticuffs: The rumble over adversary sophistication
It has been a reoccurring theme for corporate victims of a major breach to publicly state that the attack perpetrated on them was sophisticated. Some may even go so far as to have their 3rd party DFIR partner(s) make statements on their behalf to the effect that the attack would have been successful at most companies. All this is done in an attempt to avoid the dreaded assumption of IT Security negligence on their part. Imagine if the press release stated that the attack might have been thwarted if they implemented processes and controls that were recommended by internal staff years ago. While we will never read that statement, many practitioners are left to wonder what was so unique and advanced about this attack. With this presentation we will present analysis of existing public attacks against traits that are more common in truly advanced attacks. These include but are not limited to the ability to operate undetected, precise targeting, use of non-public zero days and custom payloads, ability to defeat in place security controls, strong operational security, speed and of course overall effectiveness. We will also make clear delineations between what constitutes and advanced attack versus an advanced adversary. The output of this will be a model that can be applied to help characterize your adversaries capabilities.

avatar for Paul Jaramillo

Paul Jaramillo

Paul Jaramillo has over ten years of experience conducting incident response and enterprise security operations, including a career with the U.S. Department of Energy’s National Nuclear Security Administration. As a Principal Consultant based out of CrowdStrike’s St. Louis office... Read More →

Saturday July 15, 2017 5:30pm - 6:20pm CDT
Williford A
Filter sessions
Apply filters to sessions.