While human attack vectors are now generally acknowledged to “be a thing” in INFOSEC, there are two immediate points we should make:

(a) Human attack vectors have been seen to be important in abstract for at least forty years – with overused phrases of humans being the weakest link of security. However, it is becoming clearer and clearer that understanding human attack vectors concretely is still elusive to the general (managerial) population.

(b) There is a substantial amount of gatekeeping in our field, where only spending weeks on obscure code and finding a 0-day or the ability to script Metasploit is considered “true” hacking, while exploiting human inability to premeditate is not. We are expected to bow to the technological supremacy of techno nerds and not point out that the threat model in both cases often remains the same.

In the talk, I will explore this curious divide in INFOSEC through examples and we will further look empirically at how lack of familiarity with concepts we pay lip service to, but in some cases do not understand fully, leads to potentially disastrous (or at least tragically amusing) fails in security.

Containers have revolutionized software deployment, but with great convenience come new security risks.
In this session, we'll explore how containers work under the hood, common security pitfalls, and best practices for building and running secure containerized applications. We'll also demonstrate real-world container breakouts and discuss how attackers can exploit misconfigurations

A recent rise in fake CAPTCHA scams has led to a spike in user-triggered infostealer infections resulting in significant cryptocurrency losses among Slovenian victims. The HijackLoader malware abuses steganography to hide its encrypted payload within the PE resource, bypasses user-mode hooks, and executes direct syscalls within its shellcode. It combines NTFS transactions and process hollowing to deliver the final crypto-stealing payload.

What is reproducibility, why it matters and common issues in achieving it accompanied by short demos
and discussion about counterpoints against reproducible builds.

Rootkits are malicious software that is designed to gain unauthorized access to a computer system and is able to hide its presence in the system. Rootkits are not only used by cybercriminals, but are also used for espionage and state-organized cyber attacks.

In this lecture, we will explore where malware can hide within a computer - even in the motherboard's chipset and deep inside the CPU - and how you can protect against such threats. We will presentseveral real-world examples of rootkits and discuss various research on hiding malware deep down within information systems.

Preboot Execution Environment (PXE) is a widely used network boot technology that allows machines to boot over a network without local storage. However, this convenience comes with security risks. In this session, we will explore how PXE works and how attackers can exploit misconfigurations to extract passwords and gain unauthorized access. Through practical demonstrations, we will analyze real-world attack scenarios, discuss potential countermeasures, and provide security best practices to defend against PXE-based attacks.

Lecture: Introduction to OSINT and Passive Reconnaissance Techniques

Back in 2007 I was enthusiastically entering the security startup World. Almost two decades later, I still (mostly) fail at making money with security. Learn from my mistakes!

Historically, managing TLS certificates was a pain, and letting a certificate expire on your website due to forgetting to renew it wasn't uncommon. Then, Let's Encrypt came along and made this much easier with everyone's favourite tool: automation!

Unfortunately, Let's Encrypt's automation doesn't work for everything. One of these cases is getting a TLS certificate for Tor Onion Services (those with a .onion domain). This talk covers the technical work required to get ACME (the protocol used by Let's Encrypt) to work for this scenario, and the political work to get it through the IETF as a formal standard.

A short introduction to Capture the Flag competitions.