If you are the kind of person who enjoys workshops with practical information that you can immediately apply when you go back to work, this workshop is for you, all action, no fluff :)

Attendants will be provided with training portal access to practice some attack vectors, including multiple mobile app attack surface attacks, deeplinks and mobile app data exfiltration with XSS. This includes: Lifetime access to a training VM, vulnerable apps to practice, guided exercise PDFs and video recording explaining how to solve the exercises.

This workshop is a comprehensive review of interesting security flaws that we have discovered over the years in many Android and iOS mobile apps: An entirely practical walkthrough that covers anonymized juicy findings from reports that we could not make public, interesting vulnerabilities in open source apps with strong security requirements such as password vaults and privacy browsers, security issues in government-mandated apps with considerable media coverage such as Smart Sheriff, apps that report human right abuse where a security flaw could get somebody killed in the real world, and more.

Michael Wylie brings to you an introductory hands-on fundamental malware analysis workshop. IT and Cybersecurity professionals will learn the basic skills necessary to safely analyze the characteristics and behavior of malware. Students will walk away with practical techniques and methodologies that can be immediately applied to statically and dynamically analyzing software with an emphasis on malicious software. Gone are the days where incident responders reformat infected systems destroying valuable evidence. Preserving and analyzing malware artifacts will give attendees the skills to understand, at a high level, the techniques and malicious intents of malware that defeated their security controls. Once the threat is understood, additional detective and preventive controls can be put in place resulting in faster response. Throughout this workshop, students will learn about and how to work on labs involving both static and dynamic software analysis. Before diving in, students will be given an overview of malware analysis and be educated on safe responsible malware detonation to minimize the risk of spreading malware. Tools students will explore include: Strings, Wireshark, PEstudio, ProcMon, HxD, Process Hacker, Process Explorer, and more.

This will be a workshop that allows students and professionals to understand both pentesting and AWS by setting up various systems in AWS. Attendees will engage by setting up an attacker host, a couple of victim machines, and a couple of other AWS services. Once the environment is set up, attendees can expect to learn basic pentesting concepts as well as some more intermediate and advanced topics.

There are far too many pieces to the information security puzzle for one person to know them all. That’s OK, but there are still quite a few topics which warrant at least some basic level of understanding. One such topic is the typical malware kill chain. Those interested in different aspects of security may find they know nothing about this. They may also find the desire to learn.

If the best way to learn is by doing then let’s “do” some malware.

Students of this workshop will learn how to:

• Build (harmless) pluggable implants for Windows in C
• Run simple command-and-control and related services
• Tie these pieces together into a usable kill chain

Please note we will not cover evasive or persistence techniques. The instructor is not a malware expert and has no intentions (yet) of arming the populace.

This workshop aims to provide a bit of fun and understanding around botnets and the kill chains used to build them. Students will take away a basic but (hopefully) new perspective on something they may have only read about in passing, but more importantly a spark to encourage continued research and experimentation at home.

Prerequisites

Attendance Requirements