The Hackers Conference - Where Professionals and Hackers Meet

I had the privilege to have my paper accepted and invited to speak at The Hackers Conference in New Delhi, India. This is my second time speaking in security conferences in Incredible India. The first time was at Kerala.

What i find fascinating was how professional the conference was organized and conducted. The key note speakers were interesting especially when politicians were involved and how the Indian government is making an effort to work together with the brilliant security enthusiasts of India into developing the country's cyber security framework. Personally, i feel that with the increasing amount of Indians into cyber security and the nation's bright students and education shifting its gear from just programming and application development into creating of cyber security application, tools, policies and frameworks, i foresee that India will be one of the top leading nation when it comes to Cyber Security in 10-20 years time.

The Banner from its website

I also had the privileged to meet security professionals that have been in the security community scene globally. One of them was Rahul Sasi, a speaker and a hacker that had spoken to most top notch conferences worldwide, and the other was Mohit Kumar, the author and webmaster of The Hacker News website. 

Me with Mohit Kumar

Me with Rahul Sasi

The topics were interesting from general security to deep level technical talks. I enjoyed most of the talks and its great to see students showcasing their research in 'breaking' stuffs. Despite not able to catch some of the speakers words as English was not their primary language, i still had a great time listening and viewing the content of their slides. Some are too wordy and some simply filled with pictures. 

The Topics

Eventually, it was the talks that made the conference alive. Due to time factors, i had to shorten my talk hence, i was not able to elaborate and articulate some of the key slides in my presentation. Despite that, i managed to share the key points of my contents of the talk..something the audience should be able to take away.

And of course, what better to way to end the day than to receive the goodies/souvenirs from the conference!

A file folder, a brochure, a cup and for the speakers; a plaque of appreciation.

I even got myself a certificate of appreciation for attending the conference! How cool is that?! 

Everyone that made this a successful conference!

BSidesLV - An Awesome Security Conference!

BSidesLV is a security conference in the US, more specifically in Las Vegas! Yeap, that's right.. Sin City! I was excited and privileged to be accepted as a speaker at the conference. As it was my first time speaking in America, it was quite a challenge for me as i know that unlike audience in Asia, American audience seems to be more outspoken and when i was there it was indeed true.

After i arrived at the Tuscany Suites and Casino, my stomach started to hurt. That's right, the pressure, the stress...there's so many butterflies rampaging in my stomach as i walked to the reception. The queue to register was long. Initially i joined in the queue but then i saw some individuals 'bypassing' them. I assumed they must have been the speakers so i asked the volunteers and phew... i managed to get in without queuing.

Once i got in, i didn't waste any time and start to take as much pictures as i can. Well, i was a tourist when i was there so excuse my itchy fingers to snap pictures. The atmosphere was awesome, the people were friendly and the topics were great! Despite not properly socializing with the crowd, i was having a great time there. Well, i am a sucker for conferences, so such a con made me feel belonged.

When my time was up, i walked up to the 'stage' and connect my computer to the VGA cable to extend my monitor. I spent the first 4 minutes trying to get it connected. Resolution sadly gave me an issue so i had to make do with a slightly smaller yet still visible resolution on the projector. I was nervous and things that i was prepared to say, those words just got lost. But i was happy that the audience, despite my pressured state, were very supportive. Some were smiling, some were nodding their heads, showing signs of approval with every slides i went through. Of course, i was challenged by another speaker who told me off about the practicality of my talk after i shown two clips from Die Hard 4.0. After replying to him saying that, it is possible for a scene like Die Hard 4.0 to happen and telling him that my last few slides will show it how, he with his 3 other friends, all wearing black tshirts, stood up and walked out of the conference room..and i was just on my slide 4. I was a little demotivated but i am glad that the rest stayed until the end. What i didnt expect was the audience gave me a round of applause after my talk! I was very touched and felt a little emotional, feeling appreciated despite my stressed mode and pressure.

After the talk, i was approached by a handful of people from the audience, asking me more about my talk. Some asked about my talk and some congratulated me about my performance. I was very happy to hear from their own words that they enjoyed my presentation. And what's more important was that i got to meet some experts in the field i was talking about.

All in all, it was an amazing experience, this was indeed one of the best conferences i attended. The organizers, the volunteers, the speakers and the audience were simply awesome! It truly felt like home...

Here are some of the pictures...

Where it all happened!

The souvenirs!

 Bought and Free Tshirts!

Close up of the Badge!

Some sponsor banners!

Mini booths

WiFi Pineapple!! I bought one!

Protiviti! - Looking for Security Enthusiasts to join them.

Big Ass O-Wasp!

Hackers For Charity booth!

CTF Competition! 

Social Engineering Competition!

Creative Winning Trophy!

 The Topics!

 The start of my presentation 

 Me with Chris Sistrunk aka SCADA God!

Me and Jack Daniels, the co-founder of Security BSides conference!

This volunteer (on the left in yellow) was the man who motivated me and encouraged me not to be pressured and even helped me answered a question from the audience! Kudos to him! Wished i knew who he is..

Support our Troops! I mean..Sponsors... :)

World War Zero - Time Magazine

This month's Time magazine has a very fascinating cover and the title is quite enticing especially to those people in the information security field.

"World War Zero! The global battle to steal your secrets is turning hackers into arms dealers."

A short preview of the article below simply made me wanna get the magazine.

So after i got my hands on a copy, i flipped straight to the article. The article is mainly about a story of a hacker called Aaron Portnoy who loves to find bugs and zero days on software and applications and how bugs are now becoming a profitable business for both the good guys and bad.

The image below 'A Bug's Life' is a high level portrayal of the stages involved when selling a bug. 

$33,500 for a Facebook bug!!! Holy Molly!!

One scary thing about Critical Infrastructures is that there are many of them connected to the Internet!

And i loved the conclusion of this article.

Speaking at Vegas!

It is my pleasure to share that my talk i submitted to BSidesLV entitled: "Vulnerability Assessments on SCADA: How i 'owned' the Power Grid' has been accepted!!!!

This will be my first time speaking at a security conference in the US! (also will be the first time to travel to the US!) I've spoken at conferences in Singapore, presented in Dubai and demoed in India. This will definitely be a new experience. Definitely i am very excited for this and will feel pressured especially knowing that the US audience are outspoken unlike its Asian counterparts.

Just a brief intro to my talk; i will be talking about the state of SCADA security, the typical vulnerabilities found in SCADA environment and how it's possible for someone to own and control a Power Grid. 

Check out the site: http://www.bsideslv.org/

First Published Article in Hakin9

Recently, i was selected to be involved to perform an assessment on a SCADA environment. It was an amazing experience getting to see the SCADA systems, the monitoring and the control systems that control the powerplants and power grids. Although there were many challenges faced during the assessment, it allowed me to develop my own methodology for performing a Vulnerability Assessment on SCADA networks.

I was more than happy to share the basic requirements and techniques on how to properly perform a VA on SCADA networks/systems to Hakin9. Unfortunately, you need to subscribe to Hakin9 before you can download a copy.

Link: https://hakin9.org/advanced-exploitation-with-metasploit/

GISEC (Gulf Information Security Expo & Conference) Dubai - 2014

GISEC (Gulf Information Security Expo & Conference) Dubai - 2014

I was pleased to be selected as part of a team to demonstrate BT's capability in GISEC conference recently which was held at the Dubai World Trade Center. I contributed to the idea of having a 'Cyber Challenge' to the BT booth inspired by the exposure i have from attending to hackers conferences. I was also given an area to showcase the Ethical Hacking capability providing demonstration and presentation to passerby.

It was a very tiring and satisfying experience! Given the fact that i was able to come up with an end to end demo by myself without any critics from management gave me a sense of confidence they have on me to deliver.

First, it was the Cyber Challenge stand. This challenge is about the ability for a pentester to be able to find a XSS vulnerability and exploit it. Day 1 challenge was to inject a script inside the affected parameter and provide an alert pop up. Day 2 challenge was to 'deface' a website by embedding an image on it and Day 3 challenge was to inject a script that will come out with an output in the result section and upon clicking on it, will be redirected to another page.

Sound simple right? But during the 3 days, only 3-4 people managed to complete the challenge.

On the ethical hacking stand, my job was to perform demos on anyone who has the interest to see it. I was happy to know that some people came up to me and said that the booth managed to gather a huge number of people, mostly were curious to see the demo. I won't go into the details of my demo but all i can say is that the demo was similar to the demo i presented with a colleague at Defcon Kerala, India last year.

But one of the best and memorable moments was the fact that i got to meet many strangers in the professional world and exchanging contacts after that. Well, thats what we called 'Networking'. All in all, it was a great and superb experience and i am sure this will continue in the near future.

Below are some of the pictures taken:

Anti Virus is Dead..So What's Next?

When i was in GISEC (Gulf Information Security Expo & Conference) in Dubai this year, i presented demos on the BT booth demonstrating how a web vulnerability called XSS (Cross Site Scripting) can be further used to gain access to the browser as well as the systems using the art of social engineering. Through using two different exploit frameworks, i was able to demonstrate how i was able to create a payload to bypass any Anti Virus applications that was installed on the victim's machine.

After the demonstration, i showed them an online article and asked them, what do they think should be done to protect the hosts or workstations given the fact that, according to the article, Anti Virus is dead. Majority of them couldnt provide me a straight answer. Some mentioned to install firewalls, others said that patches must be properly updated and installed. While the answers might help to prevent, the solution i recommended to them was 'Endpoint Security'.

http://www.pcworld.com/article/2150743/antivirus-is-dead-says-maker-of-norton-antivirus.html

'Endpoint Security' has many definitions and one of the definitions i usually referenced to is the fact that it is a solution that consists of not just an Anti Virus but a host based behavioural blocking components such as an IDS/IPS (Intrusion Detection/Prevention Systems), a host based firewall, Anti Spyware component as well as NAC (Network Access Control). With these components installed, as i explained to them, although my payload will be able to bypass the Anti Virus and Anti Spyware components, the IPS will definitely detect it and will prevent it from being executed.

http://www.techrepublic.com/blog/it-security/endpoint-security-what-makes-it-different-from-antivirus-solutions/

"But i have a NIPS (Network Intrusion Prevention Systems) and a firewall that will protect external attacks from penetrating my internal systems and servers." claimed a person. "But what about your own internal employees attacking your infrastructure?" I questioned him back while i showed him an online article. According to an article last last year, 58% of information security incidents were attributed to insider threat. We have seen many cases, due to relaxed policies, employees are able to bring their own devices to connect to the organization's network, able to bring external storage drives and plug it into the organization's machines and of course, users having administrative privileges to execute and install third party software in their organization's machines. These situations potentially allow malware coming into the internal networks and spreading throughout the organizations.

http://www.infosecurity-magazine.com/view/32222/58-information-security-incidents-attributed-to-insider-threat-/

While there will never be a patch for human stupidity, security managers must quickly propose a solution to protect their networks from both external and internal attacks. While having security mechanisms protecting the perimeter of the organizations are able to deter external threats, most organizations fail to understand the critical need to protect for possible internal threats as well. Yes, one can argue that network based solutions can protect to the scenario i demonstrated but then again, is that really enough?