News

Time left until #BSidesBUD2020

Tickets

  • BSidesBUD Pass for Individuals
    12 500 HUF

    This ticket type is valid only for individuals. The invoices will be issued just for them, companies cannot purchase this type of ticket.

     

    Buy ticket
  • BSidesBUD Pass for Companies
    25 000 HUF

    By purchasing this type, you will receive a VAT invoice for your ticket in your company’s name and address after we have received the payment.

     

    Buy ticket

Schedule

  • BSidesBUD Live! Stream // 1ST PART
    08:30 - 08:35
    Attila Marosi-Bauer - Opening Ceremony
    08:35 - 09:15
    Dr. Pedram Hayati - Immune your Javascript Programs Against Modern Vulnerabilities
    TBD later
    09:20 - 10:15
    Filipi Pires - Dissecting and Comparing Different Binaries to Malware Analysis
    Demonstrate different kind of structures in the binaries as a PE (header and your sessions), ELF (header and your sessions), PDF(header/ body/cross-reference table/trailer), explaining how each session works within a binary and where it would be possible to “include” a malicious code.
    10:20 - 10:40
    Ali Abdollahi - New Era of Telecom Hacking
    This talk focus on the implementation of new security hardening in mobile networks as well as detecting techniques and bypassing methods. The scope of the illustration include both radio and signalling core network.
    10:45 - 11:30
    Zénó Amtmann - The Art of CISO
    While corporations historically tended to outsource their IT operations, companies were reorganized and established to fulfill this demand by creating shared service centers, centralized and specialized teams focusing on specific segments of the computing environment, the amount of individuals who retained the ability to appropriately oversight a corporations' information systems environment had significantly dropped. As the business relied more and more on the IT infrastructure and this foundation was targeted by cyber criminals at an increasing rate, C-level executives had to realize that financial threats no longer occur only as a result of a financial mis-statement or fraud, it can be the result of an ineffectively or inadequately managed IT infrastructure. In addition, governmental and regulatory scrutiny mandated and mandates these corporations to ensure that the outsourced service provider(s) is(are) acting based on the corporation's best interest and that the corporation has control over the activities that they had outsourced. Consequently, the companies are facing these requirements at times when the amount of individuals who have an accurate knowledge of the topology and the infrastructure of the company is very limited. That is why the role of a CI(S)O is an art - to understand the big picture, and to communicate the risks and needs of the company to all stakeholders at their level.
    11:35 - 12:15
    Alexander Polyakov - AI Security Challenges in 2020
    AI is steadily flooding our world sipping into various verticals from Autonomous cars, Robots to Defense, Media and Smart homes. Hundreds of new startups are implementing Ai solutions worldwide and we are getting closer to the point where machine learning-based solutions will eat traditional algorithms. While we more and less understand how to deal with software vulnerabilities we have no clue what’s happening in ML-based solutions and how it's possible to hack them except probably adversarial examples which recently attracted media attention after 5 years from the initial invention. But this area is rapidly growing and we are getting to the point when there will be over 2000 research papers presented on this topic and some of them will hit media only in 5 years or so. In this presentation I will show what is happening in AI security industry, the most closed cybersecurity area. We will discuss the most critical AI applications such as face recognition, self-driving cars, voice assistants and their latest attacks. Then we will discuss ML algorithms such as classification, regression, reinforcement learning, clustering, etc… and how to attack them. An finally we will look at the particular attack methods such as adversarial, privacy, poisoning, backdoor, reprogramming, and how they evolving.
    12:20 - 13:10
    Csaba Fitzl - Exploiting Directory Permissions on macOS
    In this talk I will talk about how can we exploit applications on macOS (including macOS), where some of the directory / file permissions are incorrectly set. The incorrectness of these settings it’s not trivial at first sight because understanding these permissions are not intuitive. We see bugs from simple arbitrary overwrites, to file disclosures and privilege escalation. The concepts applicable to *nix based system as well, however this talk focuses on macOS bugs only.
    13:15 - 14:00
    Tamás Kocsis & László Kőszegi - "Elmentem Én a Vásárba Schneider Fánival" - Avagy a Hazai ICS/OT Biztonság Testközelből (HUN)
    TBD later
  • BSidesBUD Live! Stream // 2ND PART
    14:05 - 14:30
    Devlin Duldulao - Introduction to PASETO (Platform-Agnostic Security Tokens)
    JSON Web Tokens (JWTs) have become ubiquitous in the web authentication landscape over the last four years. In this talk, I'll introduce you to their successor: PASETO tokens (platform agnostic security tokens).
    14:35 - 15:10
    Tomi Tokics - A Jump Back to 2016: iOS Jailbreaking
    In this talk I will introduce iOS jailbreaking, and I will do that by exploiting two real world vulnerabilities back from 2016. These bugs were used by the famous Pegasus spyware The two bugs are: CVE 2016-4655 & CVE 2016-4656
    15:15 - 15:35
    László Erdődi - Hacking Arena: An Innovative Learning Platform for Ethical Hackers & Hacker Robots
    15:40 - 16:25
    Márk Modly - Unboring XML Attacks - Forgotten Methods
    TBD later
    16:30 - 17:10
    Mutaz Alsallal - Threat Hunting in Kubernetes
    While organizations are utilizing containers and microservices architecture, the threat landscape has been evolved. Security Operation Centres needs to extend their detection and prevention capabilities to hunt for the threats in such an environment. The talk will go deeply into this new landscape, and to detect the related security threats at multiple layers, at the container, underlying host OS, and the whole kubernetes cluster.
    17:15 - 18:00
    Saurabh Chaudhary - YARA Rules on Steroids
    Whenever we want to proactively hunt for malware of interest for threat intelligence purposes, YARA is the swiss-army knife that makes the work of malware researchers and threat intelligence Researchers easier. Malware developers work just like legitimate software developers, aiming to reduce the time wasted on repetitive tasks wherever possible. That means they create and reuse code across their malware. This has a pay-off for malware hunters we can learn how to create search rules to detect this kind of code reuse, Traditional Yara rules are written on strings, but if we implement code leveraging YARA code reuse rules in addition with the strings rule the rule will last decades. for successful and long-term hits, we have to combine both string-based and code-based coverage. The key to efficient YARA rules depends on simple and clear rulesets utilizing both.
    18:05 - 19:00
    Anastasios Pingios - A Gentle Introduction to Build a Threat Intelligence Team
    The talk is focusing on people that are not sure on how to start their journey to the world of threat intelligence. By the end of this talk we would have gone through the process, common pitfalls, and a road to success for an intelligence-driven security function. More importantly, the talk will give you the answer to whether or not an intelligence team is something that is worth pursuing for your organization at this point in time and if not, then when it is the right time for you to expand to this area.
    19:05 - 19:30
    Philipp Krenn - Security Tradeoffs in Elasticsearch
    The NoSQL ecosystem thrived on combining scalability and simplicity. This talk focuses on some assumptions we built Elasticsearch on, which helped the ease of use initially, but turned out to be less than perfect for security in the long run: * Binding to all interfaces and broadcasting join requests to the whole subnet makes clustering simple. * Running as root is the straightforward option. * Using a general purpose programming language for scripting adds lots of features. * Guessing the content-type of a request is fine. * Default passwords and clear-text password files are a reasonable tradeoff. * Docker and distributed systems play well with your security efforts. * Generating TLS certificates is easy. * Everyone will turn on security and defaults are easy.
    19:30 - 19:35
    Attila Marosi-Bauer - Closing Notes
  • Online Workshop Sessions
    09:00 - 11:00
    Davy Douhine - iOS Mobile Hacking
    The workshop is the iOS (very) short version of a 3-days training dedicated to learn the basics to be able to assess the security of mobile applications (Android and iOS). Davy Douhine (@ddouhine) will share many techniques, tips and tricks to deliver to pentesters, bug bounty researchers, app makers or just curious a 100% hands-on iOS workshop. Goals: – Understanding common mobile vulnerabilities – Understanding iOS basics – Understanding of the OWASP MSTG (Mobile Security Testing Guide) and the MASVS (Mobile Application Security Verification Standard) – Know how to build an iOS pentest toolset
    11:00 - 11:10
    Break (10 mins)
    11:10 - 13:10
    Guillaume Lopes - Android Mobile Hacking
    The workshop is the Android (very) short version of a 3-days training dedicated to learn the basics to be able to assess the security of mobile applications (Android and iOS). Guillaume Lopes (@Guillaume_Lopes) will share many techniques, tips and tricks to deliver to pentesters, bug bounty researchers, app makers or just curious a 100% hands-on Android workshop. Goals: – Understanding common mobile vulnerabilities – Understanding Android basics – Understanding of the OWASP MSTG (Mobile Security Testing Guide) and the MASVS (Mobile Application Security Verification Standard) – Know how to build an Android pentest toolset
    13:10 - 13:20
    Break (10 mins)
    13:20 - 15:20
    Ali Abdollahi - Hunting Malware in Documents (Practical)

Speakers

What is BSides?

Security BSides is the first grass roots, DIY, open security conference in the world!  It is a great combination of two event styles: structured anchor events and grass-roots geocentric events.

“ It is no failure to fall short of realizing all that we might dream.

The failure is to fall short of dreaming all that we might realize. ”

Dee Hock, Chairman Emeritus, Visa International

‘Security BSides is a community-driven framework for building events for and by participants in the information security community. It creates opportunities for individuals to present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction by participants. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. This is where conversations for the next-big-thing happen. The open platform gives community participants a rare opportunity to directly share ideas, insights, and develop longstanding trusted relationships with others in the community.’ Security BSides

Read More

What participants said about BSides?

You should come if…

… you’re a student who’s interested in IT security…

… you’re  student who wants to work in the field of IT security…

… you’re an IT professional who wants to build relationships with similar experts…

… you want to meet/talk/exchange experience with people who has similar interests…

… you are interested in the latest trends of IT security…

… you want to experience the international atmosphere of BSidesBUD…

Copyright © 2020 BSidesBUD. All Rights reserved.