Archives

You spend days or even weeks perfecting the perfect phish; your campaign has a targeted pre-text, a slick initial access payload and it slips through perimeter defences right in to your target’s inbox. Moments later, your c2 pings and your beacon is awake – you’re in, it’s time to explore! You start by probing the […]

In the 1968 television series, the Prisoner, a former British intelligence agent is imprisoned on an island called ‘the Village’ with other former spies who “know too much.” Escape is near impossible for the prisoners, who are only referred to by their numbers. We’ll assume the role of “Number Six” in this session and engage […]

Many organizations greatly benefit from moving their infrastructure to cloud, providing additional scalability, availability and seeming ease of use. But these features come with a price: the complexity of cloud deployments and configurations lead to significant exposures and could lead to sensitive data disclosure or even compromise of the cloud infrastructure. This presentation will present […]

On the Windows platform, macro-based attacks are well understood (and frankly are rather old news). However on macOS, though such attacks are growing in popularity and are quite en vogue, they have received far less attention from the research and security community. In this talk, we will begin by analyzing recent macro-based attacks that target […]

This talk covers how we can exploit applications on macOS (including macOS itself), where some of the directory / file permissions are incorrectly set. The incorrectness of these settings is not trivial at first sight because understanding these permissions are not intuitive. We will see bugs from simple arbitrary overwrites, to file disclosures and privilege […]

In larger enterprise environments multiple Active Directory forests are often in use to separate different environments or parts of the business. To enable integration between the different environments, forest trusts are set up. The goal of this trust is to allow users from the other forest to authenticate while maintaining the security boundary that an […]

Low-power, single-purpose embedded devices (e.g., routers and IoT devices) have become ubiquitous. While they automate and simplify many aspects of our lives, recent large-scale attacks have shown that their sheer number poses a severe threat to the Internet infrastructure, which led to the development of an IoT-specific cybercrime underground. Unfortunately, the software on these systems […]

Networked ATMs have been in continuous operation since the 1980s, and with that comes an industry built around legacy software, hardware, and network protocols. These are the original “IoT” devices, and it shows – picking apart many ATMs will reveal the dirty secret of a dial-up modem hiding behind steel walls. Despite this, the high […]

In 2018 McAfee ATR began to re-focus on identifying and tracking the operations attributed to Hidden Cobra / Lazarus group to better understand and reveal activity never seen before. In this talk we will present research conducted by McAfee Advanced Threat Research into the threat actor known as Hidden Cobra and the various operations targeting […]

Targeting better x86 platform security, Intel have created a hardware-based firmware protection mechanisms: TXT, BIOS Guard, Boot Guard and SGX. Since there’s nothing to trust at the runtime, these protections rely on a hardware boundaries set up in a manufacturing environment. This introduces only two Roots of Trusts – Intel Management Engine ROM and Intel […]