Think you have to go to Washington or Vegas for an awesome computer security conference? Think again! Pittsburgh is getting its own Security Bsides this summer, featuring awesome talks and the chance to meet other local Infosec people as well as nationally recognized experts. There are a lot of people in Pittsburgh doing awesome things in the field; let's get them all together! Oh, did we mention it's all free - even the food and beer??
- Loading...
- No images or files uploaded yet.
Call For Presenters (CFP)
Important Dates: Cutoff: May 10 Speakers Announced: May 17
List your proposed talk here. After May 17, we will vote on which ones will be presented. Don't limit yourselves to a one hour talk with Power Point (although that's fine) - we'll gladly entertain creative new ways to present information!
Please list your: name, contact information (email, twitter, website), presentation title, and short description. E.g., We will also accept CFP submissions via an e-mail to bsidespgh@gmail.com.
Dan Klinedinst (@dklinedinst) 3D Modeling and Visualization of Real Time Security Events
This talk will introduce Gibson, a tool for modeling real time security events and information in 3D. This tool will allow users to watch a visual representation of threats, defenses and compromises on their systems as they occur, or record them for later analysis and forensics. In addition to continuous monitoring for operational network security, it can be used by strategic and tactical decision makers, or to display the progress and results of cybersecurity training exercises or penetration tests.
Johnny Cocaine (@johnnycocaine) "Behind The Mirror Shades: The Making of Johnny Cocaine"
“Johnny Cocaine” could be (and has been!) described as many things – an attempt to gather covert intel on the black hat community; performance art; an experiment in social networking; a technology sandbox; an agent provocateur for the infosec community; even an exploration of identity, memes and, well, truthiness online. Join "him" for this first ever in-depth look at creating a fictional online persona that can stand up to investigation by nation-state actors and the most tech savvy criminals in the world. Techniques and technical details for data mining, counterintelligence, attacking anonymity, social engineering, and more.
Chris Teodorski (@Can0beans) Fun with SSH Honeypotting
Kippo is a medium interaction SSH honeypot. I've been running Kippo for awhile now and I've discovered some interesting and unusual things. For my talk, I will present a brief intro to Kippo, an explanation of how it works, and why I think running a honeypot is a worthwhile exercise. I'll also present the results of my experience and hopefully provide the audience with a little insight into the mind of an SSH hacker.
David C. Brown Business Performance Improvement, Compliance, Security, and eDiscovery—How to Get It Right.
Describes why the traditional stovepipe approach to solving them does not work and what to do about it.
Kizz MyAnthia (Nicholas Donarski) @kizz_my_anthia "Weaponizing The Smartphone: Deploying The Perfect WMD"
The acceptance and integration of mobile phones, specifically smartphones, into our everyday life has allowed for these devices to penetrate deep into secure areas. The ability to have your phone along with you at any moment of the day feeds our needs for social media, email, business, and pleasure. This ability and access has allowed the use of smartphones to be bred into devices that rival other penetration testing hardware/software combinations.
Eric Irvin (@SecRunner) Nice Guys Finish Last: Why Doing the Right Thing Sucks
Dave Kennedy / ReL1K (@dave_rel1k, www.secmaniac.com) Strategic Pentesting - The Penetration Testing Execution Standard (PTES)
Penetration testing has grown into a full-fledged industry and a critical component to our information security program. We'll be covering where we've gone, where we're going, and what needs to happen to fix the issues we see currently in the penetration testing industry. The penetration testing execution standard is a new standard developed by the information security community to fix the problems we face as an industry. This presentation will cover the evolution of penetration testing, it's place in the industry, and where PTES is positioned and where it's going.
James Paulick Esq. (http://jkplawfirm.com) Cybercrime law - electronic search and seizure.
Search and seizure law is as old as the U.S. constitution. No issue in the criminal law of evidence is more contested than the legality of evidence seized by law enforcement officers. Over time, the law has been molded and crafted by judges and legislators to effect the intent and mandates of the Fourth Amendment protections from "unreasonable search and seizure". Technology and cybercrime have introduced new constitutional boundaries and litigation battle lines within search and seizure law because of the distinct natures between physical and electronic evidence. We will explore some recent examples of how prosecutors, defense attorneys and the judiciary are dealing with this techno-legal conundrum
Tim Hollebeek Payment Security Standards: How they’re made, and why they have bugs too
This talk will provide a quick overview of payment security standards (X9, PCI), then move on to a description of how these standards actually get made, including case studies of actual “bugs” in security standards and requirements. Some editorial commentary about the difficulty (and importance!) of getting security requirements right will be inevitable.
Spencer McIntyre APeak and EAPScan, Wireless Foot Printing for 802.1x
The presentation will be a demonstration of our new open source tool EAPeak and EAPScan. Attendees will understand how EAP types are used to authenticate clients and how to determine useful information when performing a security assessment. Finally a demonstration of the new EAPScan tool will be given, which bridges the gap of passive reconnaissance to active enumeration of EAP enabled wireless networks.
Alex Volynkin Full Disk Encryption: Defending against cold boot attacks on encryption keys Full disk encryption has become an essential element of organization data protection. It has been demonstrated that full disk encryption is prone to cold boot attacks that exploit data remanence properties of RAM. We can prevent Cold Boot attacks. I will present an overview of the full disk encryption technology, an actual cold boot attack, and a set of software-driven techniques for protecting its cryptographic keys. These software techniques do not involve the use of any specialized hardware or encryption chips. Instead, the techniques utilize specialized cryptographic transformations, memory system and operating system operations, and certain architectural features of general-purpose processors. The methods can defend against Cold Boot attacks on machines that have been shut off, on machines in hibernate and sleep modes, and even on machines in screen lock mode.
Deral Heiland From Printer to Owned: Leveraging Multifunction Printers During Penetration Testing In this presentation we go beyond the common printer issues and focus on configuration data available on multifunction printers (MFP) that can be leveraged to gain access to other core network systems. During this presentation I will be discussing how poor printer security, and discovered vulnerabilities can be leveraged to harvest a wealth of information from MFP devices including usernames, email addresses, and authentication information including SMB, Email, LDAP passwords. I will also be discussing the real world penetration testing scenarios and how MFP data was gathered and used to successful gain administrative access into core systems, including email servers, file servers and Active directory domains on multiple occasions. We will also explore MFP device vulnerabilities including authentication bypass, and information leakage flaws. Tying this altogether we will discuss the development of an automated process for harvesting the information from MFP devices with the beta release of the tool ‘PRAEDA’.
Ashley Brown How Social Media is used to drive Online Pharmacy Sales Social media networks play a significant role in today’s society and in many cases consumers rely on social media for official answers. As the rising cost in prescription drugs skyrocket so does the increase in online pharmacy networks, leading to an array of counterfeit pharmaceutical products available for purchase.
Schedule
Topics I would like to hear about
Potential SponsorsOver the past two years, a series of information security events called BSides has been organized across the U.S. and internationally (www.securitybsides.com). These events vary in format, but share the common philosophies that they are free, open to anyone, and entirely organized and run by volunteers. Another common trait they share is that they focus on the community where they are held, with mostly local speakers, local sponsors, and local vendors.
Planners (bsidespgh@gmail.com)
Volunteers
Task List(please -cross out- when it's done)
Tech
Wifi Projector, White Boards Photo Video Audio Streaming or Stickam or Skype or Ustream or Livestream
Non-tech
Breakfast Lunch Coffee/Tea Tables and chairs
Tags for flickr, twitter, blog, etc.Please use the tag #BsidesPGH for content related to this event
|
|
|||||||||||||||||||||||||||||||||||||||||||
Comments (0)
You don't have permission to comment on this page.