Security BSides Ljubljana

Abstract:
On average it takes between 6 to 10 hours for online adversaries to target a cloud hosted server. This is without even publishing the cloud host IP address. The intrusions are organized in separate layers to make them more efficient and economical. The questions are who these attackers are and how these attacks are orchestrated?

To answer these questions, we have deployed a number of custom made honeypots across major cloud providers for the past year. During this period we have discovered a number tactics used by attackers that are constantly targeting onlines businesses. We have applied advance network theory techniques to profile adversaries that resulted in uncovering secret connections among most online attackers. In this paper, I will go through some of these findings which are both interesting and informational for people in IT security community. I will also give away a few tips to protect and harden cloud hosted servers.

Bio:
Pedram Hayati is Director at Security Dimension with over a decade of industry and academic experiences in technical IT security space. Pedram has a PhD in Computer Science and has a number of international publications, presented at well-known industry and academic conferences. Moreover, his research studies on botnets and Cloud security have been featured in international media.

Abstract:
Snowden shocked the world, but few were surprised. Many were amazed by the scale and complexity of the infrastructure. How could so many people be involved in such a massive system without the secret getting out? Surely something that big didn’t need a whistle blower to come forward for everyone to know! The truth of the matter is, looking back in our modern history books you need not look too far before seeing similar operations of magnitude being undertook. Just as secretive, just as wide reaching, and with the pursuit of ensuring ‘freedoms’ the Manhattan Project showed what can be achieved. Its hard on initial inspection to see the similarities between the pursuit of nuclear weapons and how global interception of communications have anything in common, but they do! By inspecting our past it becomes less surprising and shocking that something of this size can be undertook with few people ever realising it or questioning it.

An inspection of Manhattan Project and the recent disclosures have found many interesting and yet surprising recurrences. It is the speaker’s hope by highlighting these recurrences and drawing parallels from our pasts people can start to see where, why, and who are the catalysts for these systems. As the Russians say; Keep one eye on the past and your blind in one eye, keep both eyes on the future and your blind in both!

Bio:
Arron “finux” Finnon has been involved in security research for a over 8 years. Arron has discussed a wide range of security related topics at a number of Security/Hacking conferences in both the UK and internationally, as well as producing over 100 security related podcasts. Interviewing countless security professionals as part of the Finux Tech Weekly podcast show.

During Arron’s time at The University of Abertay Dundee he was also awarded the SICSA Student Open Source Award for his Advocacy of Free and Open Source software for his work whilst president of The UAD Linux Society.

Arron now spends his time between consulting as well as research for Alba13 Research Labs, a company which he founded.

Abstract:
Cyber Europe 2014 (CE 2014) is the largest and most comprehensive EU cyber-security exercise to date. It is a multi-event cyber exercise that involves more than 400 cyber-security professionals from 29 EU and EFTA countries and 200 organisations, including: Computer Security Incident Response Teams, Cyber Security Agencies, EU bodies, public entities, Telecoms operators, ICT vendors and energy service companies.

Bio:
Razvan Gavrila has been a network and information security expert for the European Union Agency for Network and Information Security since 2011. He is currently working under the Operational Security Unit, contributing to the Agencys programs in the area of cyber crisis cooperation and exercises.