IOActive is a proud sponsor for this year’s 8th Annual JoAnn McGovern Memorial Golf Tournament taking place on September 27 at the Silverado Resort & Spa in Napa, California.
“Enjoy a day of golf, food and fun. It’s going to be a great day and you’ll support an even greater cause – the fight against pancreatic cancer. The tournament is held in memory of JoAnn McGovern, whose life was cut short by this devastating cancer. The tournament is presented by the McGovern Family Pancreatic Cancer Awareness Foundation.”
Gunter Ollmann, IOActive CTO, will take part in a panel discussion hosted by Dark Reading on August 8 during this year’s Black Hat in Las Vegas. The panel discussion, ‘Weaving AI into your Defenses,’ focuses on how security teams can apply AI technology into their operations.
ABSTRACT:
It’s not just cybercriminals and nation-states that can use artificial intelligence (AI) to automate and elevate their operations. AI also offers security teams both a new tool and a new weapon to fortify their defenses. How can you apply AI technology in your security teams? How do you integrate it with existing processes and tools? In this panel discussion, Dark Reading editors and security experts discuss how AI is poised to transform the security operations center and its security teams to raise their level of defenses to a more advanced and proactive posture.
Nick Dunn, IOActive Senior Security Consultant, will host a workshop, ‘Scripting and Coding for Penetration Testing,’ at this year’s BSides Tirana taking place September 19 – 20.
Workshop Abstract:
The workshop introduces scripting for beginner and intermediate level hackers.
It will concentrate on using bash and Python to chain together multiple tools. Attendees will learn how to run tools and automatically parse the output, with a few example scripts, before moving on to scripts to run Nmap, read the resulting output to locate exploitable devices, and automatically exploiting them with the MSF RPC API.
After the session, attendees should have enough information to write reusable scripts for their testing needs and be able to save themselves a large amount of time on future tests.
Check out the BSides Tirana website and register today!
IOActive is a proud sponsor at this year’s BSides Bristol taking place Friday 30th & Saturday 31st August 2024.
“BSides Bristol is an event for people interested in the Information Security industry; an opportunity to learn, share ideas, mingle and expand your network with other like minded people. Our events suit blue-teamers, red-teamers and anyone in between with workshops, engaging talks and networking opportunities.”
Check out the BSides Bristol website and register today!
Check out Nick Dunn’s talk, ‘You Left the Back Door Open! (Finding Legacy Vulnerabilities in Legacy Systems),’ at this year’s Steelcon taking place 19 – 21 July. Nick’s talk takes place on Saturday at 10:00 a.m.
You Left the Back Door Open! (Finding Legacy Vulnerabilities in Legacy Systems)
AS/400 is an IBM mid-range computer series (i.e. not quite a mainframe) that’s undergone multiple name changes over the years (but still gets referred to as AS/400 by lots of people). Despite it’s age, the system is extremely stable and scalable, and still in widespread use.
This talk discusses the history of the system, and shows how the design, and computing conventions of the time have led to many of these systems existing in a vulnerable state. The talk will show how to test and exploit systems, what tooling can be used, and how to harden and protect the system. There are large numbers of these systems still in use, with many configured in a default (or almost default) state that allows easy exploitation to anyone armed with the right tools and techniques.
It demystifies a system that’s often regarded as obscure or unusual, shows what hacking techniques are needed, and best of all a lot of the hacks involve hollywood-style green text in a black terminal window.
Check out this Official DEF CON talk from Enrique Nissim, Principal Security Consultant at IOActive, and Krzysztof Okupski, Associate Principal Security Consultant at IOActive, “AMD Sinkclose: Universal Ring-2 Privilege Escalation.”
System Management Mode (SMM) is one of the most powerful execution modes in the x86 architecture and code at this level is invisible to the Hypervisor and OS-level protections, including anti-cheat engines and anti-virus systems. While the BIOS ecosystem’s complexity has led to a multitude of vulnerabilities in firmware over time, vendors are now making strides in delivering patches with greater speed and efficiency. Unfortunately, these efforts are not enough in the presence of a CPU vulnerability.
When researching the AMD processor, our team noticed a flaw in one of the critical components required for securing SMM. This silicon-level issue appears to have remained undetected for nearly two decades.
This presentation starts by providing an introduction to SMM and the security mechanisms that the AMD processor provides to support it. Subsequently, it delves into the CPU design flaw and the complete methodology and engineering used to create a universal ring -2 privilege escalation exploit.
Back to the Future with Platform Security by Krzysztof Okupski
The Memory Sinkhole – Unleashing An X86 Design Flaw Allowing Universal Privilege Escalation by Christopher Domas
IOAsis is back online in Las Vegas! Join us August 9 – 10 at the IOActive exclusive event ‘Speakeasy in the Sky’ at Horseshoe Las Vegas.
We are excited to welcome our VIPs to relax, enjoy some complimentary food, and attend exclusive talks. Please register to request an invitation: https://info.ioactive.com/acton/media/34793/ioasis-advanced-registration-2024
This Year’s Featured Talks & Events | Horseshoe Las Vegas, Suite #2602
*Talk times & topics are subject to change. All times are in PT.
Friday, August 9
Auto-ISAC Sponsored Talks & Brunch (Food to be Served)
Talks
- 1:00pm – 2:00pm | One Click to Launch Them All: A Single Source for Centralized Fuzzing | Alejo Moles, Senior Security Consultant, IOActive
- 2:00pm – 3:00pm | Demystifying SR-IOV Vulnerability Hunting | Joseph Tartaro, Principal Security Consultant, IOActive
- 3:00pm – 4:00pm | Red Team Now or DFIR Later | Gunter Ollmann, CTO, IOActive
- 4:00pm – 5:00pm | Insights from Security Executives: Optimizing Security Budgets | Moderated by Scott Headington, Managing Director of Global Services, IOActive
- 5:00pm – 6:00pm | Fortifying the Future: Tackling the Challenges of Testing and Securing Modern Applications | Gunter Ollmann, CTO, IOActive, & Tim Lekan, Global Technical Account Manager, Edgescan
Evening’s Event
- 6:00pm – 9:00pm | IOActive & Edgescan Happy Hour
Saturday, August 10
Talks
- 11:00am – 12:00pm | From Fault Injection to Silicon: Securing Tomorrow’s Devices Today | John Sheehy, SVP Research & Strategy, IOActive
- 12:00pm – 1:00pm | Ransomware Keeps Holding us Hostage. Are You Ready? | Lance Reck, Director of Services, IOActive
- 1:00pm – 2:00pm | OCP S.A.F.E. Space: Why it Matters to You | Gunter Ollmann, CTO, IOActive
- 3:00pm – 4:00pm | Integrated AI: Using the Open-Source Fabric Framework to Automate Work and Life | Daniel Miessler, Founder, Unsupervised Learning
- 4:00pm – 5:00pm | Mastering Golang: Unleashing the Power and Perils (Mostly Perils) of Concurrency | Ilja Van Sprundel, Senior Director of Operating Systems, IOActive
- 5:00pm – 6:00pm | Becoming Rich with Just One QR Code | Antonio Requena, Senior Security Consultant, IOActive
Evening’s Event
- 6:00pm – 9:00pm | IOActive Happy Hour
Check out Alejo Moles Ramos’, IOA Senior Security Consultant’s, tool talk at this year’s Black Hat in Las Vegas. ‘PinguCrew’ is a web-based fuzzer platform that allows security researchers to test their software for vulnerabilities in a scalable and efficient manner.
PinguCrew runs the tests on the user’s own machines, giving them full control over the fuzzing process. This allows for more customization and flexibility, as users can set up their own testing environments with their desired configurations and testing parameters.
Pau Oliva, IOActive senior consultant, will be presenting at this year’s BSides Barcelona. Pau’s talk, ‘Fightcade: Online Retro Gaming,’ is a deep dive into the fascinating world of retro game emulation, where he explains techniques to hack emulators that enhance classic games with modern features. His talk starts at 1pm!
Gabriel Gonzalez, Director of Hardware Security at IOActive, will be joining a panel discussion at this year’s Cybercamp-UMP to discuss hardware security. The panel discussion will focus on the latest trends and strategies to defend against cybersecurity threats. Check it out and immerse yourself in the dynamic world of secure hardware. The panel discussion is May 21 and starts at 17:00 CET. Register today to attend!
