![44CON Information Security Conference](/img/default-banner.jpg)
- 215
- 272 304
44CON Information Security Conference
United Kingdom
Registrace 22. 10. 2011
Content from 44CON an annual Information Security Conference and Training event taking place in London, United Kingdom
For more from 44CON and tickets visit 44CON Website: 44con.com
---=== Contact ===---
CZcams: czcams.com/users/44contv
Website: 44con.com
Twitter: 44con
LinkedIn: www.linkedin.com/groups/44Con-3886577
For more from 44CON and tickets visit 44CON Website: 44con.com
---=== Contact ===---
CZcams: czcams.com/users/44contv
Website: 44con.com
Twitter: 44con
LinkedIn: www.linkedin.com/groups/44Con-3886577
Tony Gee - Getting In: Initial Access - 2023 and beyond
Presented on Thursday 14th September 2023 at 44CON 2023
The pathway to initial access in 2023 is far from an easy one. This talk will lift the lid on all the recent techniques, tactics and procedures (TTPs) we have both been using to gain access and seeing clients targeted with.
The days of initial access being a case of sending a basic phishing email and get creds are long gone. With email filters so much more effective, end user training more frequent, corporate procedures enhanced, phishing is hard. We need to think differently, we need to be creative. That is what this talk is all about. Showing you the TTPs we have developed over the years to evade or even bypass corporate controls and trick staff into giving us access. We will reveal the TTPs that we have seen our clients targeted with in recent months and we have developed ourselves over time. This is much more than phishing, this is full scope social engineering initial access, showing the many ways of getting in and gaining initial access in 2023 and beyond.
Tony Gee:
Tony Gee, Social Engineer, OSINT & Intelligence Analyst, Pen Test Partners
For 15 years, Tony's job has been either trying to break technology or defend it from attack. This he has done everywhere from banks to mass transport systems. He specialises in open source intelligence and social engineering, providing intelligence and understanding, helping clients understand their exposure and providing insight and access for red and purple teams. He also speaks the world over at technology and cybersecurity events about how anything from children's toys to cars, planes and ships can be hacked. He has spoken at PCI events in Europe and Asia, at the ISC2 Congress, ISACA CSX Europe, SANS Awareness Conference, WIRED Smarter, technical conferences such as 44Con and BSides. Most notably, he has spoken to US Congress and the European Central Bank about how the underlying digital theories and systems which modern life relies on, are vulnerable to attack.
The pathway to initial access in 2023 is far from an easy one. This talk will lift the lid on all the recent techniques, tactics and procedures (TTPs) we have both been using to gain access and seeing clients targeted with.
The days of initial access being a case of sending a basic phishing email and get creds are long gone. With email filters so much more effective, end user training more frequent, corporate procedures enhanced, phishing is hard. We need to think differently, we need to be creative. That is what this talk is all about. Showing you the TTPs we have developed over the years to evade or even bypass corporate controls and trick staff into giving us access. We will reveal the TTPs that we have seen our clients targeted with in recent months and we have developed ourselves over time. This is much more than phishing, this is full scope social engineering initial access, showing the many ways of getting in and gaining initial access in 2023 and beyond.
Tony Gee:
Tony Gee, Social Engineer, OSINT & Intelligence Analyst, Pen Test Partners
For 15 years, Tony's job has been either trying to break technology or defend it from attack. This he has done everywhere from banks to mass transport systems. He specialises in open source intelligence and social engineering, providing intelligence and understanding, helping clients understand their exposure and providing insight and access for red and purple teams. He also speaks the world over at technology and cybersecurity events about how anything from children's toys to cars, planes and ships can be hacked. He has spoken at PCI events in Europe and Asia, at the ISC2 Congress, ISACA CSX Europe, SANS Awareness Conference, WIRED Smarter, technical conferences such as 44Con and BSides. Most notably, he has spoken to US Congress and the European Central Bank about how the underlying digital theories and systems which modern life relies on, are vulnerable to attack.
zhlédnutí: 558
Video
Phil Huggins - Cyber Security in Health & Care
zhlédnutí 336Před 8 měsíci
Presented on Friday 15th September 2023 at 44CON 2023 Closing Keynote
Marta Janus and Eoin Wickens - Sleeping with one AI open
zhlédnutí 401Před 8 měsíci
Presented on Friday 15th September 2023 at 44CON 2023 Artificial Intelligence (AI), together with the underlying technology called Machine Learning (ML), is increasingly prevalent in our lives. It's already integrated into our personal devices, financial systems, medical equipment and critical infrastructure - and it's on course to be the main driver behind every modern solution across all sect...
Lee Christensen and Max Harley - Nemesis
zhlédnutí 162Před 8 měsíci
Presented on Friday 15th September 2023 at 44CON 2023 The offensive industry is about exploring what’s possible. Part of this is observing and taking lessons from other disciplines that have already solved a myriad of related challenges, from proper software engineering practices to using graph theory for offensive problems. But despite various leaps forward over the last several years, the off...
Jen Ellis - A Celebration of Cyber Community Action!
zhlédnutí 66Před 8 měsíci
Presented on Wednesday 13th September 2023 at 44CON 2023 Wednesday evening opening Keynote Jen Ellis: Jen Ellis is working to reduce cyber risk for all digital citizens. As founder of NextJenSecurity, she partners with security experts, technology providers and operators, civil society, and governments, to create greater understanding of cybersecurity challenges and solutions. Jen promotes bett...
John McIntosh - ghidriff
zhlédnutí 559Před 8 měsíci
Presented on Friday 15th September 2023 at 44CON 2023 This talk presents ghidriff, a new open-source Python package that offers a command line binary diffing capability leveraging the power of Ghidra with a fresh take on the standard patch diffing workflow. As seen in most security blog posts today, binary diffing tools are essential for reverse engineering, vulnerability research, and malware ...
Emanuele Cozzi - Uncursing the ncurses
zhlédnutí 70Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 We discovered a set of memory corruption vulnerabilities in ncurses, identified as CVE-2023-29491 and fixed in ncurses v.6.4 commit 20230408. These vulnerabilities can range from memory leak or denial-of-service (DoS) to elevating privileges and executing arbitrary code. An example of possible (privileged) target is "top" on macOS, which i...
Khang Nguyen - Lessons Learned from a Red Teamer's Journey into the Kernel
zhlédnutí 168Před 8 měsíci
Presented on Wednesday 13th September 2023 at 44CON 2023 Over the past few years, we have seen an increasing number of threat actors moving to kernel-based attacks such as leveraging stolen certificates to sign rootkit drivers, or Bring-Your-Own-Vulnerable-Driver (BYOVD), as it’s getting harder and harder to operate stealthily on userland. Traditionally, red teams tend to avoid kernel-land beca...
Kev Sheldrake - Detection and Blocking with BPF via YAML
zhlédnutí 99Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 BPF allows us to do great things - from hooking practically any kernel function, to blocking actions and killing processes - but it can be quite difficult to use! Wouldn't it be amazing if you could just write some YAML and a pre-existing, mature, open source, BPF engine did all the hard work? And sent events to your logs? And your email? ...
Shaun Peapell - Global Threat Services
zhlédnutí 40Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 Rootshell Security, sponsor of 44CON 2023
David Rogers - A Security Research Journey: how the mobile industry met hackers in the middle
zhlédnutí 245Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 The mobile industry has always had a relationship with the hacking community and it has often been collaborative when it comes to protecting consumers. This is the first time that the mobile industry has spoken about its work with the security research community which started with very informal relationships with hackers and developed into...
Elliot Ward - Realtime Communications, Realtime Risks
zhlédnutí 90Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 Gone are the days of long polling, bidirectional realtime communication is here via WebSockets. This transformative technology has undeniably elevated the user experience of modern applications, but it poses a critical question: how secure is it? In this talk, we deep-dive into the threat landscape of the WebSocket protocol to discover why...
James Forshaw - Missed Opportunities
zhlédnutí 498Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023
Gerald Benischke - Precision Munitions for Denial of Service
zhlédnutí 36Před 8 měsíci
Presented on Wednesday 13th September 2023 at 44CON 2023 Why use carpet bomb DDoS when a targeted strike consistent a few well crafted requests can cripple a service? As an added bonus, precision strikes make it that much easier to avoid WAF countermeasures. And where to find this amazing cyber weapon? Why in a seemingly unimportant CVSS score 7.5. Gerald Benischke: For the longest of time I ha...
Robert Sell - The Art of the Breach
zhlédnutí 110Před 8 měsíci
Presented on Thursday 14th September 2023 at 44CON 2023 The Art of the Breach is designed to be a journey for anyone interested in physical security. Robert takes the audience on a trip from the public sidewalk outside a target organization all the way through to the executive filing cabinet in the President’s office. During this adventure, Robert discusses everything from successful reconnaiss...
Peter Allwright - Snookered in the Pool Room
zhlédnutí 61Před 8 měsíci
Peter Allwright - Snookered in the Pool Room
Dave Lewis - Don't You Know Who I Think I Am?
zhlédnutí 62Před 8 měsíci
Dave Lewis - Don't You Know Who I Think I Am?
Stiv Kupchik - Lifting the Fog of War
zhlédnutí 120Před 8 měsíci
Stiv Kupchik - Lifting the Fog of War
Luke Jennings - The new SaaS cyber kill chain
zhlédnutí 270Před 8 měsíci
Luke Jennings - The new SaaS cyber kill chain
Guy Barnhart-Magen - The Log4J Rollercoaster - from an incident response perspective
zhlédnutí 62Před rokem
Guy Barnhart-Magen - The Log4J Rollercoaster - from an incident response perspective
Erlend Andreas Gjære - The Need For a Human Touch In Cyber Security
zhlédnutí 82Před rokem
Erlend Andreas Gjære - The Need For a Human Touch In Cyber Security
Pavel Tsakalidis - Codecepticon - Building an obfuscator to bypass Modern EDR and AV
zhlédnutí 393Před rokem
Pavel Tsakalidis - Codecepticon - Building an obfuscator to bypass Modern EDR and AV
Melissa Goldsmith - Threat Hunting: From Bodging to Efficiency in 7 Steps
zhlédnutí 51Před rokem
Melissa Goldsmith - Threat Hunting: From Bodging to Efficiency in 7 Steps
Kev Sheldrake - What is eBPF and why should you care?
zhlédnutí 289Před rokem
Kev Sheldrake - What is eBPF and why should you care?
Jake Roberts - The Tale Of Phineas Fisher
zhlédnutí 839Před rokem
Jake Roberts - The Tale Of Phineas Fisher
Andrew Ruddick - Exploring a New Class of Kernel Exploit Primitive
zhlédnutí 166Před rokem
Andrew Ruddick - Exploring a New Class of Kernel Exploit Primitive
Phil Eveleigh - The Office of Danger: a choose your own adventure story!
zhlédnutí 53Před rokem
Phil Eveleigh - The Office of Danger: a choose your own adventure story!
P Allwright - Lord of War-Investigating the theft of a gambling platform and outsmarting the thieves
zhlédnutí 262Před rokem
P Allwright - Lord of War-Investigating the theft of a gambling platform and outsmarting the thieves
Great analysis, thank you! I need some advice: I'm using a SafePal wallet with USDT and I have the seed phrase. (air carpet target dish off jeans toilet sweet piano spoil fruit essay). What's the best way to send them to Binance?
Incrível ❤
Amazing. Are the demo apps available anywhere?
This video is a milestone in terms of heap exploitation tutorials.
anyone can share presentation ??
I want to run my own compiled Uboot from SPI though glitching. I can do the same with NAND/NOR flash to glitch the CPU to run my own version of UBoot to get the CPU access and for that I am using pin 20 of flash IC where i load specific data and reset pin of the CPU. However, in case of SPI I am unable to understand which pin or pins should I use with reset pin to execute my own UBoot after glitching. Some of the target boards are on NAND some on NOR. I can run Uboot in case of NAND/NOR as I know on which pin I load Specific data and the reset pin for glitching but in case of SPI flash I am unable to understand what to do
Thank you Kevin for the presentation. Amazing job and amazing tool :)
Great talk! I was somewhat confused on why this talk has less than 100 views. Maybe the title is a little bit unfortunate? But at the same time I don't know what else I would have called it. Maybe just "Analyzing RPC based attacks"? That would give people the chance to search for this on CZcams.
Wp
💘 Promo-SM
Con/verse in to acquire definition discuss 5 min ago
I'm curious if she ever found something else cute to hack.
Does the sound cut out for multiple seconds at a time for anyone else 😢?
many thanks теперь все видео о тамагочи от Натали просмотрены)
Great topic and great presentation, sadly the audio is sh*t
Really interesting stuff. Lots of great information here.
the font style is hard to read
Pascing
Dub bojr and cod
Open bojr
There files open looking
What's win ,nix work headel
Files open tools jqer ,nidex ,ubty,lipc ,gedr
Atti. Files cocokis and attach files nidex fuking trying nidex files
Som vlu mein How manen files open looking. Stytimarket, credit card details explain
Win-vnzuo ted
love you queen!
he knows how to “hit and hide” very well. dude’s absolutely skilled at manipulating people’s minds which you won’t tell whether if she or he, teen or old, american or spanish, group or one. moreover, what’s interesting is how he spent couple of weeks reversing an appliance and came up with a 0-day exploit to broke in and kill the Hacking Team. that’s a pure elite hacker work lol!
Hmmmm... Exist a crack for VMAC SOFTPAY for using VX680 ? ( VERIFONE )
:D Jacket :D James, good work brother... BR
Pretty good talk, taught me some interesting stuff.
can anyone tell me why while trying to run the binary it says '' bash: ./house_of_force: No such file or directory ''
Amazing content well put together !
solved ¿?
How do you protect yourself from this?
how to make it executable ?
i got binary file form udemy course i was trying fastbin_dup and house _of_fource technique , but that binary file are not executing on my linux is showing permision denied error
chmod +x
hi how can i contact mr. max kamper i am facing issue while executing binary file its showing permision denied
Man I wish IDA wasnt that expensive.
❤❤❤❤
but does it run doom.
the answer is - very slowly
huh
He said "closing tag style" but on the screen it said <style><..... So is that correct, or is it </style><....?
I noticed my phone and computer has tried connections to trusteer recently - should I block it. I have not installed it.
are these vms paid ?
Are there any HEC devices? Haven't found any.
LOL - An hour PRESENTATION about their AP and during the demo, it does not even work.. blames it on android.. lol mmhmm.. Maybe the call needs at least 2 rings like caller-ID needs. What is the update on this years later?
how can i get the code? the link is expired
DARSHAK does not exist. Is there anything better?
Thanks for the useful API!!! :)