In ShellCon 101 I will explain industry terminology and discuss key aspects of the conference. I am a 17 year old who has been volunteering for ShellCon since the beginning and I want to help newcomers get the most out of the conference and have the full experience. Last year I knew the keynote was really funny but the vocabulary went right over my head. I will go into detail about the Hacker Village, RaiseMe, talks, the layout of the conference, and things to do in downtown San Pedro.

As a security practitioner, the trend of Agile and DevSecOps is coming. Whether developers or management are pushing for it, you should be prepared. DevSecOps sets security as a metric of success for developers and encourages security to be a consideration continually through a project lifecycle. This is a vast improvement to the usual methods of taking security into consideration only at the end, in the beginning, or avoiding talking to security at all. You should be seizing the opportunity to leverage the movement to your advantage. I want to arm you with ideas on education, resources, tools, and practices to do DevSecOps well from a Security department standpoint.

Red Team operations require substantial efforts to both create implants and a resilient C2 infrastructure. SiestaTime aims to merge these ideas into a tool with an easy-to-use GUI, which facilitates implant and infrastructure automation alongside its actors reporting.

SiestaTime allows operators to provide registrar, SaaS and VPS credentials in order to deploy a resilient and ready to use Red Team infrastructure. The generated implants will blend-in as legitimate traffic by communicating to the infrastructure using SaaS channels and/or common network methods.

Use your VPS/Domains battery to deploy staging servers and inject your favorite shellcode for interactive sessions, clone sites and hide your implants ready to be downloaded, deploy more redirectors if needed. All this jobs/interactions will be saved and reported to help the team members with documentation process.

SiestaTime is built entirely in Golang, with the ability to generate Implants for multiple platforms, interact with different OS resources, and perform efficient C2 communications. Terraform used to deploy/destroy different Infrastructure.

This will help increase companies red teams efficiency, improving industry security standards and make the defenders to catch-up , being ready for real threats.

2019 is a hell of a year. Why not make it worse by coming and hearing from one of the world’s foremost experts on mainframe hacking? ‘Hmm’, you’re thinking, ‘mainframes who cares?’ If you’re using any type of credit card (yes even Apple Pay) you care. It is the most important piece of equipment in any enterprise. So how come you still think they’re unhackable?. This talk will go over SNA hacking, VTAM, TSO, CICS, privesc, REXX, and CLISTs, walking through the various techniques successfully used on pentests. Introducing new tools to help conduct penetration tests. You will see how easy it is to get started with mainframe hacking and all the tools currently available today.

Airplane hacks can ground one flight, mainframe hacking can ground the fleet.

Developers often do not know what the common issues are with the framework they are using. At the same time, most common frameworks ship with easy ways to shoot your application’s security in the foot. In this world we live in, developer education will fail if even one mistake is made, which will expose a dangerous vulnerability. In this talk, we’ll show how you can dramatically reduce the chance developers will shoot themselves in the foot by giving them safer versions of their common tools so your company can ship more secure code. We will write wrapper classes and safe versions of common tools to eliminate XSS vectors, open redirects, XXE, SSRF, LFI, and other dangerous bugs in your codebase.

MacOS is a popular operating system across Startups and Fortune 500 companies. Few commercial tools exist that provide proper event visibility in MacOS. Often, these tools are expensive and some lack important monitoring features. However, open source offers a great selection of tools that can be deployed to kick start a MacOS Threat Hunting Program. In this talk, I will simplify threat hunting, select a few open source tools, and guide the audience on a methodology to hunt for threats in MacOS.

Every day we hear about weak security of IoT devices, about vendors that don’t take security seriously and how using and not changing default passwords could lead to a leak of important and personal data. GPS trackers made with a default password and predictable serial numbers allow full control of the tracker and leak the user’s position. Due to heavy white labeling and use of the same cloud infrastructure the scale of the problem is huge. I’m going to show and discuss where the weaknesses are, what models and APIs are affected and how they can be exploited. Live demo included. The talk is by itself also a comprehensive guide on analyzing IoT device security, spanning from Android app to HW.

PErfidious is a Python3 tool that aims to directly take a benign PE executable and malicious shellcode, transform the malicious shellcode and inject the transformed shellcode directly into various parts of the executable’s .text section, thus completely avoiding the need to look for code-caves or creating additional sections. After injection, PErfidious recalculates the size of the .text section and all the virtual address changes caused by the increase in the size of the .text section and modifies respective fields in the PE header, thus making sure that the PE file doesn’t look injected.

Competitions are everywhere in cyber security, but have you ever wondered what it takes to create one? This talk covers the challenges of creating an exciting competition that helps people develop skills and covers the challenges faced in building infrastructure to support competitions. We will primarily be covering CCDC competitions (Collegiate Cyber Defense Competitions) but we will also cover capture the flag competitions through the lens of a competition organizer and the challenges faced. If you are interested in competing in or want to help put together an competition, this talk is for you.

Software developers are the foundation of any application. In order to achieve secure software, developers must be supported and helped by the organization they author code for. As software developers author code that makes up a web application, they need to embrace and practice a wide variety of secure coding techniques. The OWASP Top Ten Proactive Controls (2018) is an OWASP documentation project that lists critical security techniques that should be included in every software development project. This document was written by developers for developers to assist those new to secure development.

Since the 2014 Sony Pictures hack, studios and post production houses all over Hollywood have been the target of attacks. In 2017, a hacker targeted and successfully compromised Larson Studios, a family-owned post-production house, exfiltrating “Orange is the New Black” Season 5. The attacker demanded ransom to keep the content from being uploaded to The Pirate Bay.

This talk will give a behind the scenes view of the film making process from a content security and blue team defensive perspective. Learn the digital workflow that goes into making the blockbuster films you love and where the industry is vulnerable to attack. Hear campfire stories from one of 30 MPAA Certified Trusted Partner Network Assessors worldwide.

This talk will go over a new tool I’m releasing, NAT Pinning v2. NAT Pinning allows an attacker to remotely access any TCP/UDP services bound on a victim machine, bypassing the victim’s NAT/firewall (arbitrary firewall pinhole control), just by the victim visiting a website. It uses multiple techniques to be cross-platform, cross-browser, and multi-protocol. Some areas we’ll cover:

• NAT (Network Address Translation)
• Router Investigation
• Firmware Dumping
• Reverse Engineering Firmware
• Network Protocol Investigation
• Browser Protocols
• Timing Attacks

Xamarin allows developers to create mobile applications for both iOS and Android using C#. The managed code is compiled into the app and later executed by the mono runtime once started. Hooking the C# methods can be challenging, especially early in the start process when trying to bypass root or jailbreak detection. This talk will demonstrate a methodology that can be used for early C# method hooking of Xamarin release builds on both iOS and Android.

We all know that encryption is a critical component to modern security, but it’s not enough to sprinkle encryption on you data as if it’s magic pixie dust. Sometimes we take the finer points for granted. In this talk we’ll cover the history of encryption in broad strokes. Then we’ll dig into some basic concepts: What’s the difference between encrypting and encoding data, or is the difference only semantics? Can obfuscation be considered a type of encryption? What’s the difference between transposition and substitution ciphers? Between stream and block ciphers? What’s a cipher?!? Is TLS/SSL symmetric or asymmetric? (hint: it’s both). We’ll conclude with some practical discussion, such as what can I use in my project?

With how many apps are running in the cloud, hacking these instances becomes easier with a simple vulnerability due to an unsanitized user input. In this talk, we’ll discuss a number of different methods that helped us exfil data from different applications using Server-Side Request Forgery (SSRF). Using these methods, we were able to hack some of the major transportation, hospitality, and social media companies and make $50,000 in rewards in 3 months.

Application security reviews are big part of Application Security Programs. It’s an important topic for all organizations, especially for those with externally facing websites or/and APIs. I perform security reviews of 3rd party software we use and custom built applications. In this talk I will focus on an organization’s custom built application security review.

As users move to the world of Mobile Apps, it becomes important to understand the security and privacy risks around Mobile Apps. This session will delve into security and privacy issues like secure mobile app development, third party SDK security, cryptographic storage, IP protection among others.

Remediation is a crucial step when recovering from an incident. Proactively implementing security controls and hardening an environment doesn’t need to wait until AFTER an incident has occurred. The presenter will detail common remediation strategies that are used when responding to breaches, in addition to risk-reduction methods that align to proactively applying a remediation strategy.

Many companies use commercial static analysis tools (SAST) to find bugs, but these SAST tools tend to be expensive, have high false positive rates, and are difficult to customize. “Lightweight” static analysis tools hit a sweet spot that is more powerful than grep but still simple enough that you can write your own.

In this talk, we’ll describe how to create your own lightweight static analysis scripts using open source libraries and tools. These techniques can be used by penetration testers to more effectively find bugs and/or integrated into CI/CD checks by security engineers to raise the security bar of the applications they support.

On the ground (e.g. during Non-Technical OS-INT), many unforseen small conflicts may arise. The ability to think on your feet paired with an ability to read people’s basic statistical probabilities and a sense of charisma can make the difference between exiting the conflict unscathed and tanking the excursion.

The ability to follow the same basic skeleton of social engineering procedures helps shape one’s ability to assess a conflict, identify goals, assess resources available based on general statistical knowledge, plan, and launch an attack that will neutralize the conflict while protecting the asset/target/bystander.

Discusses basic tenets of certain aspects of psychology, sociology, anthropology, etc., to pull together strategies to assess, formulate, and launch on the fly as the situation demands.

Also makes fun time-killer when out on the town.

The major cause of API and web application insecurity is insecure software development practices. This highly intensive and interactive 4-hour seminar will provide essential application security training for web application and API developers and architects.

The class is a combination of lecture, security testing demonstration and code review. Students will learn the most common threats against applications. More importantly, students will learn how to code secure web solutions via defense-based code samples.

Our focus will be web application security basics.

• OWASP Top Ten 2017
• OWASP Top Ten Proactive Controls v3
• OWASP ASVS 4.0

This workshop will take student’s Wireshark skills to the next level with a heavy emphasis on incident response, threat hunting, and malicious network traffic analysis. We will begin with a brief introduction to Wireshark and other Network Security Monitoring (NSM) tools/concepts. Placement, techniques, and collection of network traffic will be discussed in detail. Throughout the workshop, we’ll examine what different attacks and malware look like in Wireshark. Students will then have hands-on time in the lab to search for Indicators of Compromise (IOCs) and a potential breach to the network. There will be plenty of take home labs for additional practice.

Introduction to Linux Memory Corruption is an introductory workshop aimed at teaching students the basics of reverse engineering and exploiting stack based overflows on modern systems (AMD64). This workshop is aimed at students with no prior reverse engineering or exploitation experience and takes them through writing their first memory corrupting exploit.

Requirements

• Experience writing and reading code (C/C++/assembler preferred)
• Linux computer or Linux virtual machine
• Understanding of common numbering systems including base 2, 10, and 16
• All required software installed (list to be sent out before class)

Recommended

• Experience using a debugger and/or disassembler
• Experience reading and/or writing assembly for at least one architecture
• Understanding of common calling conventions
• Understanding of memory segments and allocation

Please come to the workshop with the following already set up and ready to go. There will not be time during the workshop to complete these setup tasks.

• x86_64 Linux VM or system (preferably kali) NOTE: THIS MUST BE A 64BIT DISTRO AND COMPUTER
• Linux man pages (man 2 and 3)
• Make sure the following software is installed: nasm, gdb, objdump, readelf
• Install gef with gdb and verify that it works https://gef.readthedocs.io/en/master/
• IDA Pro 7.0 freeware or licensed copy https://www.hex-rays.com/products/ida/support/download_freeware.shtml...</p> Read More
  
  </div>
  Joe Rozner

  

  Joe is a member of the Red Team at Verizon Media where he plots world domination and builds offensive tooling. He has a passion for reverse engineering, exploitation, teaching, and sharing research with others. He is the undisputed champion of the Brawndo and Booze competition from DEFCONs past with his Irish...

  Read More
  
  @jrozner
  </div> </div>
  Cryptographic Attacks and Attack Tools for People who Hate Math

  • Track: D: Friday 10/11 @ 1300-1700 PDT

  Many cryptographic exploits require little to no understanding of math, but cryptography’s reputation as an impenetrable Gordian knot of arcane symbols and proofs (thanks, academics) keeps many capable application security professionals from even TRYING to understand cryptography.

  Consider the replay attack: capture an encrypted message and send it again, with catastrophic results, if, for instance, the message means “transfer $100 from my bank account to yours.” If you understood that, congratulations, you’ve just learned one way to attack modern cryptosystems. Come learn about more attacks that don’t take math chops to understand, and learn to use attack tools for the attacks that do!

  Read More
  
  

  Daniel Crowley

  

  Daniel Crowley is the head of research and a penetration tester for X-Force Red. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it. Daniel is the primary author of both the Magical Code Injection Rainbow, a configurable vulnerability testbed, and FeatherDuster, an automated cryptanalysis tool....

  Read More
  
  @dan_crowley
  RF and Wireless Hacking 101

  • Track: C: Saturday 10/12 @ 0800-1200 PDT
  • Slides

  Wireless devices are becoming exceedingly prevalent in our homes and offices. Many companies are making a switch to wire-free workplaces for the sake of convenience and cost. But how safe are these devices and connections, and how do hackers go about breaking into wireless systems? This course will explore some basic concepts of radio frequencies and associated wireless security topics through a lightning series of content presentation, demos, and hands-on labs. If you bought that Alfa card but haven’t got around to learning how to use it yet, this is the class for you. We will cover exploits for Wi-Fi, Bluetooth, RFID, and 2.4 GHz wireless mice, along with exploring software defined radio and topics for further individual research.

  Course Requirements:

  • Laptop (recommend running Windows bare-metal, with VMware and enough disk space / memory for a virtual instance of Kali)
  • iOS or Android mobile device with the free nRF Connect application installed

  Someone without any special equipment should still gain a deep perspective on the topics to be covered however the following equipment will be useful:

  • Wi-Fi: Wireless adapter capable of packet injection and monitor mode (recommend Alfa awus036ach)
  • BLE: Nordic NRF52840-DONGLE, Optional Ubertooth One
  • 2.4 HID:...</p> Read More
    
    </div>
    Maxine Filcher

    

    Maxine is a US Army Veteran, who recently graduated from the University of Washington – Tacoma with a BSc in Information Assurance and Cybersecurity. She has experience as a Security Analyst hunting wireless threats and vulnerabilities, and currently works for IOActive as a Security Consultant applying her knowledge to help companies...

    Read More
    
    @FreqyXin
    </div> </div>
    Exploiting and Securing Group Policy

    • Track: D: Saturday 10/12 @ 0800-1200 PDT

    Defenders, this training will show you common Group Policy Security misconfigurations and how to mitigate them. Red Teamers, if you’re looking for a new way to get Domain Admin, this is for you as well. Hands-on demos are included to give you a chance to practice what you’ve learned.

    Students must have a laptop with virtualization software (VirtualBox, VMware Workstation, etc.) and at least 40GB of drive space free. A basic understanding of Active Directory, PowerShell, Group Policies, and authentication concepts is helpful but not required.

    Read More
    
    

    Hudson Bush

    

    Hudson Bush is a Security Architect that injects Threat Modeling into everything he does. He mostly works with Government Regulatory Compliance, Risk Management, and Business Impact Analysis. His goal is to teach others about the mistakes that he has made so that others don’t have to repeat them.

    Read More
    
    @homebrewedsec
    SIEM, Splunk, Logging, and Alerting Lab

    • Track: C: Saturday 10/12 @ 1300-1700 PDT

    Hands-on exercise setting up a lab for stimulus-response based alert writing using the free version of Splunk as a SIEM. Includes installation of Splunk log forwarder, Splunk Enterprise GUI console, log forwarding configuration, log normalization, stimulus-response activities, log review, and alert writing. Methodology good for Blue Teams looking to build alerts based on actual attack output; good for Red Teams looking to understand the output from their activities.

    Requirements:

    VirtualBox VMs will be provided with networking pre-configured. Hands-on familiarity with basic *nix command line strongly encouraged. Enough CPU/RAM to support at least 1 VM, either *nix or Windows, whichever is least similar to the host OS.

    Read More
    
    

    Mary Cordova

    

    Mary is a member of the Splunk Trust, an elite brain trust of about 60 of the most experienced Splunk users around the globe who give back to the Splunk community. She has worked in the threat detection and response space for various industry leaders in gaming, media, and entertainment and...

    Read More
    
    @cyphoid_mary
    Beefy McStudly's PowerShell Workshop

    • Track: D: Saturday 10/12 @ 1300-1700 PDT

    This is Studly McBeefy’s and Beefy McStudly’s PowerShell workshop. The aim of this workshop is to get you competent in PowerShell quickly. There are no quirky gimmicks or “master class” shenaniganry here. Our approach is simple; we’ll walk through a bunch of things you should know and see what happens. If you’re the curious type you’ll dig deeper in each area on your own. If not, you should still be able to fumble though quite a bit. At the end of it all you should be able to read a lot of the PowerShell out there, and be able to churn out simple code to accomplish a wide range of tasks.

    Read More
    
    

    Pookiebear

    

    Pookiebear is an Incident Responder at a leading healthcare provider. He has several years of experience using scripting to solve business, technology, and operational problems.

    Read More
    
    

    WHITE CHRIS

    

    StudlyBeefyMcBeefyStudly is many things — DEF CON Goon, Chaotic Neutral Troublemaking Aficionado, Fornax Coversapien, Principal Systems Engineer, Raging Alcoholic, Firestarter… The list goes on. They have spent nearly 20 years bringing the fruits of their exploits to the techomancing world. Originally starting out with desktop software and then web application development,...

    Read More
    
    @bad2beef