9:00 Welcome to BSidesNH!
9:15 ICS Security Gaps: Are We
Harry Thomas, Senior Security Consultant
The increase in malware over the past couple years has shown that attackers are becoming more proficient in Industrial Control Systems (ICS). Our critical infrastructure was built on the premise of availability and integrity but because of the need to keep our critical infrastructure running, many of our environments are left under protected. The ICS security gaps have not been identified clearly or communicated effectively to the community. Through my research and experience securing and protecting critical infrastructure I will explain: the current status of the ICS networks, what has been learned over the past few years, and how to proceed forward.
Harry Thomas is an Information Technology and Industrial Control System Security Consultant with experience across multiple industries. Harry has performed security assessments for businesses small to large. The security assessments that Harry has performed ranges from standard IT risk and security program assessments, IT audits, architecture design and review of IT and ICS network. He has utilized his technical skills from an offensive and defensive perspective to help build more secure networks for his clients.
10:00 Ghost in the Shell: When AppSec
Tony Martin, Principle Engineer
Home and Business Network Access Devices – because of their complexity and the large number of provided plugins for expanded functionality – continue to suffer from security problems, have been hijacked by cryptocurrency-mining botnets, and continue to be the target of ransomware. Digging through some of the more popular brands uncovered multiple severe security vulnerabilities including reflected and stored XSS, OS command injections, authentication bypass, and more. This presentation will cover many of the vulnerabilities, showing how they can be chained for full system exploit. In the course of the investigation, a new class of weakness was uncovered, Ghost in the Shell, that allows for the creation of Ghost admin accounts with Shell access that are not viewable by normal administrative means. This weakness impacts more than just these NAS devices but potentially any system where there may be a discrepancy between the web-based user management and the underlying operating system used for authentication.
Tony Martin is a Principle Engineer at a Fortune 50 company where he is the chair of the software security architecture review board and provides guidance on threat modeling and secure development lifecycle processes. He holds a Master of CS Security from Boston University, a Bachelor of CS from the University of Maine, and has twenty CVEs to his credit. Tony volunteers with a few organizations including Boys Scouts and is a member of the staff at DEF CON’s Packet Hacking Village.
10:45 I Know Your Password
Patrick Laverty, Penetration Tester
Passwords are the keys to the kingdom; they are how we access so many of our services. Until we have proper multi-factor authentication on everything, the password will be the one thing keeping our services and data safe. This presentation uses real-world research, not just from dumps found online, to analyze what types of password people use in their company domains. We’ll talk about password cracking, how to do it, and more efficient ways to crack password hashes. We’ll also talk about the typical passwords that people use. While they may not be the same ones you’ll see on ‘Top 10’ lists of bad passwords, it may still be eye-opening at just how easy it is to guess your way into a network.
Patrick is a penetration tester for
Rapid7 and creator/organizer for the Layer 8 conference in Rhode Island. He
runs the Defcon401 group in Providence. He does research into password usage
and has written blog posts for Rapid7 about his findings. Previously, he worked
in the CSIRT for Akamai Technologies and was a web developer at Brown
University for twelve years. He lives in Rhode Island and plays baseball (not
softball) and ice hockey in his spare time.
11:30 Securing Smart Homes and Home
Automation Devices -Present and Future
Jay Hartley, Founder and President, A Cloud of My Own
This presentation will focus on the smart “things” market and the risks these devices bring with them through the dramatically increased (and poorly defended) attack surfaces they create. Specific examples will be cited and reviewed. We will quickly review the current and pending regulations worldwide and their impact (what they will solve and what they won’t.). A quick review of upcoming security frameworks that can be built into the products under development will be explored before introducing the I2P2 Framework (Isolate, Identify, Profile and Protect).
Jay Hartley is a hands-on technology executive with experience in defining and implementing cybersecurity programs and solutions across a variety of industries. From the earliest days of HIPAA and PCI, Jay has been ensuring that companies and the critical information they maintain remain secure. His current mission is to provide security in the Internet of Things, primarily focused on the Smart Home / Home Automation market.
1:00 How to Be “All You Can Be” in Your Tech Career
Roy Wattanasin, Healthcare Information Security Leader
Come to this talk to hear hints and tricks of how to continually accelerate your career in infosec and tech to “be all you can be”! Roy will provide a history of how he got started in security and how he was able to do well in his positions over a 20+-year career. This talk will be exciting and geared toward everyone, no matter at what point you are – new or a seasoned professional. Roy brings along 10+ years of being a healthcare adjunct information security faculty member to graduate students and as a mentor. He additionally has been part of many organizations along the way specifically in the New England area. This is a talk that you will not want to miss and there will be lessons-learned to be used right away. Furthermore, he also re-cofounded Security BSides Boston back from hiatus a couple of years ago.
Roy Wattanasin @wr0 is a healthcare information security professional and faculty member of over 10 years. He has experience in many industries. Roy spends most of his time developing information security programs, teaching students, performing incident response and helping to build the local communities. He is affiliated with OWASP Boston, ISSA, Security BSides Boston and more.
1:45 Chinese and Russian Hacking
Winnona DeSombre, Threat Intelligence Researcher & Dan Byrnes, Intelligence Analyst
Chinese and Russian dark web hacker communities: one of these things is not like the other, regardless of what popular culture would have you believe. This talk will explore the origin, organization, content and current landscape of Russian and Chinese hacking communities. By showcasing different forums and correlating geopolitical and past cybercrime/hacktivism-related events, we explain how and why either country’s hacker communities are unique, with their own codes of conduct, forums, motives, and payment methods.
Dan Byrnes is an intelligence analyst at Recorded Future, who monitors the Russian and English-speaking underground criminal forums, and has worked for such companies as as the National Cyber-Forensic & Training Alliance and Symantec. Dan has presented his research on various types of threat actors to members of law enforcement and private industry alike, as well as giving the occasional guest lecture at the University of New Hampshire.
Winnona DeSombre is part of the cyber research team at Recorded Future. She focuses on Chinese underground hacking communities and East Asian cyber espionage campaigns. Prior to working at Recorded Future, Winnona worked at MITRE and MIT Lincoln Laboratories updating legacy systems in government software, and at the Harvard Belfer Center conducting policy research.
2:45 Hunting for Lateral Movement:
Offense, Defense, and Corgis
Ryan Nolette, Independent Security Researcher
Once inside your network, most cyber-attacks go sideways. They progressively move deeper into the network, laterally compromising other systems as they search for key assets and data. Would you spot this lateral movement on your enterprise network?
In this training session, we review the various techniques attackers use to spread through a network, which data sets you can use to reliably find them, and how data science techniques can be used to help automate the detection of lateral movement.
Ryan is an independent security researcher. He has previously held a variety of roles including AWS’s primary security technologist, threat research, incident response consulting, and every level of security operations. With over a decade in the infosec field, Ryan has been on the product and operations side of companies such as Amazon AWS, Sqrrl, Carbon Black, Crossbeam Systems, SecureWorks, and Fidelity Investments. Ryan has been an active speaker and writer on threat hunting, cloud security, and endpoint security.
3:30 Hackers: What We Think We
Helen Negre, Product Security Officer and Data Privacy Advisor
The study behind this presentation sought to describe the group of people known as Information security professionals. Five hundred and fifty-seven people, comprised of hackers, infosec professionals, and a small group of non-community members completed five surveys online including: Actively Open-Minded Thinking Beliefs AOT Assessment, Stanovich and West’s Actively Open-Minded Thinking Scale, prosocial personality battery (also known as the self-report altruism scale), Psychology Today’s Open Minded Index, and The Interpersonal Generosity Scale (IGS). Participants also provided demographic information, details of their job and community involvement, and opinions on the community overall.
Helen Negre, CISSP, is a Product Security Officer and Data Privacy Advisor for Siemens Healthineers who has worked in Information security for over a decade with a diverse set of clients. She has also taught forensics techniques and coding practices.
4:30 We give away lots of free stuff
5:00 BSidesNH 2019 Comes to a Close