BEGIN:VCALENDAR VERSION:2.0 PRODID:-//pretalx//cfp.bsidesvienna.at// BEGIN:VTIMEZONE TZID:Europe/Vienna BEGIN:STANDARD DTSTART:20001029T030000 RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 TZNAME:CET TZOFFSETFROM:+0200 TZOFFSETTO:+0100 END:STANDARD BEGIN:DAYLIGHT DTSTART:20000326T020000 RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3 TZNAME:CEST TZOFFSETFROM:+0100 TZOFFSETTO:+0200 END:DAYLIGHT END:VTIMEZONE BEGIN:VEVENT UID:pretalx-bsv2024-993J3A@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T093500 DTEND;TZID=Europe/Vienna:20241123T100500 DESCRIPTION:I guess that no day in 2024 went by without a security person c rying because they realized that their organization will employ an LLM app lication\, and they are the one responsible for its security. This applica tion will receive inputs from scary sources like customers\, emails and th e internet. But don’t you fear dear security person\, there is a securit y vendor coming to the rescue. They bring tools and APIs that can be insta lled easily\, work with everything and make all problems go away. Or do th ey? We will explore the landscape of current solutions\, see how to break them\, and release a new tool called "Sprechen Sie Deutsch?". This aims to help the security community understand these measures so that they can be improved in the future. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Didn't Last a Minute: Why We Can't Secure LLMs and Might Never - Pa ul Zenker URL:https://cfp.bsidesvienna.at/bsv2024/talk/993J3A/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-CEY7FF@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T101000 DTEND;TZID=Europe/Vienna:20241123T105500 DESCRIPTION:In this presentation\, we will delve into the often overlooked security risks associated with macOS (.pkg) and Windows (.msi) installer p ackages. Installers are a critical part of software deployment\, yet they can harbor significant vulnerabilities that\, if exploited\, can lead to p rivilege escalation and remote code execution (RCE).\n\nWe will start by u npacking the structure of macOS and Windows installer packages\, shedding light on their internal components and the common security flaws that can be exploited. Through real-world examples and demonstrations\, we will exp lore how attackers can leverage these flaws to gain unauthorized access an d control over systems.\n\nAttendees will learn about the following key ar eas:\n\nUnderstanding Installer Packages: A comprehensive overview of the structure and function of macOS .pkg and Windows .msi files.\nCommon Secur ity Flaws: Identification and explanation of typical vulnerabilities found in installer packages.\nPrivilege Escalation: How malicious actors exploi t installer flaws to escalate privileges on both macOS and Windows platfor ms. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:The Dark Side of Installers: Security Flaws in macOS and Windows - Giriraj Ravichandran\, Naveen S URL:https://cfp.bsidesvienna.at/bsv2024/talk/CEY7FF/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-7WSPY8@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T101000 DTEND;TZID=Europe/Vienna:20241123T104000 DESCRIPTION:LLMs turn out to be highly practical for summarising and extrac ting information from unstructured Cyber Threat Intelligence (CTI) reports . However\, most models were not trained specifically for understanding th e lingo of CTI. We will present our custom\, local LLM\, fine-tuned for CT I purposes. But how would we know if it's any good? That only makes sense with a CTI text benchmark dataset. Trying to solve these two challenges wa s quite a journey. Set-backs guaranteed. We will share our findings. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Fine-tuning an LLM on CTI reports for fun and profit - Jürgen Bran dl\, Aaron Kaplan URL:https://cfp.bsidesvienna.at/bsv2024/talk/7WSPY8/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-NF9TK8@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T104500 DTEND;TZID=Europe/Vienna:20241123T113000 DESCRIPTION:Enterprise copilots\, from Microsoft Copilot to Salesforce’s Einstein\, are adopted by every major enterprise. Grounded into your perso nal enterprise data they offer major productivity gains. But what happens when they get compromised? And how exactly can that happen?\n\nIn this tal k we will see how we can turn these trusted enterprise AI assistants into our own malicious insiders within the victim organization. Spreading misin formation\, tricking innocent employees into making fatal mistakes\, routi ng users to our phishing sites\, and even directly exfiltrating sensitive data!\n\nWe’ll go through the process of building these attack technique s from scratch\, presenting a mental framework for how to hack any enterpr ise copilot\, no prior experience needed. Starting from system prompt extr action techniques to crafting reliable and robust indirect prompt injectio ns (IPIs) using our extracted system prompt. Showing a step by step proces s of how we arrived at each of the results we’ve mentioned above\, and h ow you can replicate them to any enterprise copilot of your choosing.\n\nT o demonstrate the efficacy of our methods\, we will use Microsoft Copilot as our guinea pig for the session\, seeing how our newly found techniques manage to circumvent Microsoft’s responsible AI security layer.\n\nJoin us to explore the unique attack surface of enterprise copilots\, and learn how to harden your own enterprise copilot to protect against the vulnerab ilities we were able to discover. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt Injections - Tamir Ishay Sharbat URL:https://cfp.bsidesvienna.at/bsv2024/talk/NF9TK8/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-KQZ83W@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T105500 DTEND;TZID=Europe/Vienna:20241123T112500 DESCRIPTION:Traditional IDS benchmarks rely on predictable\, static attack patterns using predefined scripts and attack vectors. But do these methods really test the robustness of modern detection systems? In this talk\, we ’ll introduce Stealth Cup\, a new approach to IDS benchmarking that leve rages real hackers to put systems through their paces. \n\nStealth Cup cha llenges teams of ethical hackers to infiltrate simulated\, yet realistic I T/OT environments while remaining undetected. It’s a competition where s tealth is the key to victory\, and the best team walks away with more than just bragging rights.\n\nThe Stealth Cup kicks off in Q1/Q2 2025 - are yo u ready to disappear?\n\nSign up [here](https://stealth.ait.ac.at) to get the latest informations about the Stealthcup. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:Is an IDS any good\, or how skilled is your Red Team? - Manuel Kern URL:https://cfp.bsidesvienna.at/bsv2024/talk/KQZ83W/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-K3VPXA@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T113000 DTEND;TZID=Europe/Vienna:20241123T120000 DESCRIPTION:Rootkits are a specialized form of malware\, with the goal of a bsolute stealth.\nThey have lived through an evolution of development thro ugh the time\,\nas have the efforts to detect them.\nThis talk presents a detection approach based on time probes that detect the delays caused\nby a rootkit.\nThis is realized with modern eBPF technology.\nAdditionally a general overview of rootkits is given. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:Kernel Rootkit detection with eBPF time tracing - Leo URL:https://cfp.bsidesvienna.at/bsv2024/talk/K3VPXA/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-CDKBSY@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T113500 DTEND;TZID=Europe/Vienna:20241123T120000 DESCRIPTION:In today's digital landscape\, adversaries have shifted their f ocus to the cloud\, finding it easier to attack and compromise than tradit ional on-premises systems. This talk explores the asymmetry in cloud secur ity\, where attackers find the cloud environment more accessible and easie r to exploit\, while defenders struggle to keep up. We will delve into the reasons behind this imbalance\, including the global accessibility of clo ud services\, the critical role of identity as the new perimeter\, and the low barrier to entry for attackers needing only a single set of credentia ls. Additionally\, we'll discuss the lack of visibility in cloud environme nts compared to the well-established practices in on-premises setups\, and how the diverse configurations and logging systems of various cloud provi ders add to the complexity. Finally\, we will address the unique skill set required for incident response in the cloud and the industry's current re adiness. Attendees will gain a comprehensive understanding of these challe nges and learn practical strategies to enhance their cloud defense capabil ities. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Attackers Aren't Breaking In\, They're Logging In: Cloud Security A symmetry - Roei Sherman URL:https://cfp.bsidesvienna.at/bsv2024/talk/CDKBSY/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-97VDHJ@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T133500 DTEND;TZID=Europe/Vienna:20241123T140500 DESCRIPTION:I will share my experience in building defensive interactive la bs. During the talk\, I will cover typical cyber range architecture\, its pros and cons. Listeners will gain insights into how to build their own cy ber range.\nI will share the problems that listeners will most likely enco unter if they decide to build a home lab. By the end of the talk\, listene rs will be informed on how to build their own cyber range and how to avoid common mistakes. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:Cyber Range Fails: Lessons learned from building Defensive Labs - K irill URL:https://cfp.bsidesvienna.at/bsv2024/talk/97VDHJ/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-GUGKXJ@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T133500 DTEND;TZID=Europe/Vienna:20241123T140500 DESCRIPTION:The ongoing use of mercenary spyware\, such as Predator\, for p urposes beyond legitimate law enforcement raises concerns regarding privac y\, legal implications\, and the physical safety of targeted individuals\, their employers\, and those involved in these activities. Although market ed ostensibly for counterterrorism and law enforcement\, there is a well-d ocumented pattern of Predator being used to target civil society\, includi ng journalists\, politicians\, and activists. This presentation aims to de monstrate how Predator has been exposed and the impact on their operations when combined with political re-evaluations\, such as sanctions.\n\nIn th e first part\, we examine the multi-tiered Predator delivery infrastructur e network identified and exposed by Recorded Future. This includes deliver y servers\, upstream servers\, and infrastructure that is highly likely li nked to Predator customers. We illustrate how\, among other things\, spywa re operators initially responded to public reporting in September 2023 and continued their operations with minimal changes to their modus operandi. Our investigation uncovered ongoing Predator usage in at least 11 countrie s\, including two previously unidentified: the Philippines and Botswana.\n \nIn the second part\, we aim to evaluate the operational status of Intell exa’s Predator after more than a year of major publications. These inclu de Citizen Lab’s report on the hacking of Ahmed Eltantawy\, Amnesty’s Predator Files detailing leaked documents about capabilities and an in-dep th investigation into Indonesia\, and infrastructure exposure by private s ecurity companies like Recorded Future. We illustrate how public reporting \, alongside unprecedented sanctions and political efforts to combat spywa re proliferation—including the US adding Intellexa to the entity list\, an EU resolution\, a US visa ban for various individuals involved with Int ellexa\, and the initiation of the Paul Mall Process—has significantly i mpacted Predator’s operations.\n\nIn the end\, we will zoom out\, offeri ng insights into the future direction of Predator and providing an outlook on the future of the entire landscape of the mercenary spyware ecosystem. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Exposing Predator's Infrastructure: The Impact of Public Exposure a nd Heightened Sanctions - Julian-Ferdinand Vögele URL:https://cfp.bsidesvienna.at/bsv2024/talk/GUGKXJ/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-GTDZAR@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T141000 DTEND;TZID=Europe/Vienna:20241123T144000 DESCRIPTION:Source code review is a skill which complements the black-box t oolset perfectly. In this talk\, we'll go over the basics of source code r eview\, sources and sinks\, some pitfalls and learnings I had from doing ( way too) many reviews. Then\, we'll have a few challenges: Can you spot th e vulnerability of famous CVEs in the source code? Featuring Ivanti\, JetB rains and GitLab! DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:Persons who stare at Source Code. - Martin Haunschmid URL:https://cfp.bsidesvienna.at/bsv2024/talk/GTDZAR/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-WW7JUK@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T141000 DTEND;TZID=Europe/Vienna:20241123T144000 DESCRIPTION:Since 1982 we’re sending e-mails across the globe with the Si mple Mail Transfer Protocol (SMTP). Nevertheless\, just last year\, a simp le yet crucial mistake in popular SMTP implementations was discovered\, al lowing for so called SMTP smuggling. Have you ever wanted to send e-mails as admin@outlook.com while still passing SPF checks? SMTP smuggling had yo u covered! However\, with global fixes applied\, this is now another story .\n\nTherefore\, building upon the knowledge established in the initial di scovery\, this talk delves deeper into the intricacies of SMTP smuggling\, unveiling novel exploits and targeting unexpected attack surfaces. Starti ng from SMTP smuggling fundamentals\, we’re analyzing theoretical and pr actical ways to once again send an e-mail as admin@outlook.com.\n\nHence\, we again shine the light on SMTP and see what this protocol has left to o ffer! DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:SMTP Smuggling Revisited – Still Spoofing E-mails Worldwide?! - T imo Longin URL:https://cfp.bsidesvienna.at/bsv2024/talk/WW7JUK/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-GMKDT7@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T144500 DTEND;TZID=Europe/Vienna:20241123T151500 DESCRIPTION:A bit more than two years ago\, in early summer of 2022\, someo ne contacted us at the Metalab Hackspace if we would be interested in an e lectronically defective\, but probably repairable industrial coffee vendin g machine. An industrial coffee machine with a touchscreen and cocoa toppi ngs? No idea where we would find enough room for it or if it would actuall y be used\, but of course we'd be interested! DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:unexpected coffee: a dive into industrial coffee machines - Hetti\, Clemens URL:https://cfp.bsidesvienna.at/bsv2024/talk/GMKDT7/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-LJ9BFA@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T144500 DTEND;TZID=Europe/Vienna:20241123T151500 DESCRIPTION:Do you want to be a connoisseur of modern ART but always feel a bit too intimidated by it? Do you want to see the good\, the bad\, and th e ugly sides of ART? Have you ever wondered what depths lie behind somethi ng seemingly simple?\nThen this talk is for you!\nThe Android Runtime is p owering modern Android and aims to run apps - fast\, resource-conserving\, and uncomplicated. The former two were apparently more important\, but fo rtunately\, the ART is part of the Android Open Source Project - which mea ns we can look under the hood to understand better what it does for apps\, what it does to apps\, and what it could do for us. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:ART is beautiful\, but it takes a lot of work - Jakob Bleier URL:https://cfp.bsidesvienna.at/bsv2024/talk/LJ9BFA/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-WEERXD@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T161500 DTEND;TZID=Europe/Vienna:20241123T170000 DESCRIPTION:An invisible\, never-ending battle is being fought between thos e creating anti-automation solutions and those finding ways to bypass them . This talk aims to provide the audience with a foundational understanding of these anti-automation mechanisms\, alongside the techniques and tools commonly used to circumvent them. Attendees will gain insights into the pr inciples behind anti-automation defences\, as well as an exploration of ho w these measures are evaded in practice. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:Anti\, Anti Automation - Alex Archondakis URL:https://cfp.bsidesvienna.at/bsv2024/talk/WEERXD/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-H83CJX@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T161500 DTEND;TZID=Europe/Vienna:20241123T165500 DESCRIPTION:In an era where industrial systems are increasingly targeted by sophisticated cyber threats\, understanding how these attacks take place and how to defend against these attacks is crucial. This presentation will provide an in-depth look at Red Team operations within Operational Techno logy (OT) environments\, such as factories and power plants. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:Red Team Operations in OT: A peek behind the curtains of hacking in dustrial systems - Sarah Mader URL:https://cfp.bsidesvienna.at/bsv2024/talk/H83CJX/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-ZJYRBU@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T170000 DTEND;TZID=Europe/Vienna:20241123T180000 DESCRIPTION:This talk seeks to demystify red team operations against compro mised Linux hosts. We'll briefly discuss the sort of things a hacker stan ds to gain\, but the bulk of the talk will walk through a reasonably repre sentative operation\, mainly sticking with common command-line tools and d emonstrating what goes on when a Linux host is compromised and\, more impo rtantly\, why. DTSTAMP:20260809T160214Z LOCATION:Track 1 (Dachssal) SUMMARY:What's the Red Team doing to my Linux Box? - Stuart McMurray URL:https://cfp.bsidesvienna.at/bsv2024/talk/ZJYRBU/ END:VEVENT BEGIN:VEVENT UID:pretalx-bsv2024-HBEFDF@cfp.bsidesvienna.at DTSTART;TZID=Europe/Vienna:20241123T170500 DTEND;TZID=Europe/Vienna:20241123T175000 DESCRIPTION:Continuous Integration and Continuous Delivery systems are omni present in today's development workflows. They help developers to focus mo re on their actual programming duties by automating repetitive tasks and a llow the periodic usage of security tools. But the messy truth is\, that i n many organizations they are simply taken for granted as yet another deve lopment tool instead of being recognized for what they are: a system at th e core of your infrastructure with almost unbounded permissions. DTSTAMP:20260809T160214Z LOCATION:Track 2 (3.1 (Kreativ)) SUMMARY:The monster in your basement: Security risks of CI/CD systems - Mat hias Tausig URL:https://cfp.bsidesvienna.at/bsv2024/talk/HBEFDF/ END:VEVENT END:VCALENDAR