exploit

Consensual software: Prioritizing user trust and safety

Consensual software: Prioritizing user trust and safety

January 23, 2020

Online safety has become a huge problem in the world of oversharing. Real-name policies, automatic geolocation tracking, and photo tagging increase user adoption rates, but these features can be quickly abused by bad actors. Danielle Leong explains how to apply a "consent filter" to product decisions to create a safer user experience and help protect your most vulnerable users from harm.
Inside the bad actor's studio

Inside the bad actor's studio

January 22, 2020

Using research from more than one billion users, 500 billion events, and 50 million malicious accounts collected from global online services, Julian Wong details some of the sophisticated attack techniques being used by modern day online criminals and demonstrates how these types of attacks can be detected and mitigated by leveraging artificial intelligence.
Cloud native: Security threat or opportunity?

Cloud native: Security threat or opportunity?

January 20, 2020

Your organization wants to go cloud native, but you don't want to hit the headlines as the victim of the latest hacking scandal. Liz Rice addresses the questions you need answers to: Will your deployments be less secure or more? How do DevOps processes like CI/CD and cluster orchestration affect your security profile? And what can we all do to minimize the risk of exploits?
traIXroute: Detecting IXPs in traceroute paths

traIXroute: Detecting IXPs in traceroute paths

January 16, 2020

Internet eXchange Points (IXP) are critical components of the Internet infrastructure that affect its performance, evolution, security and economics. In this work, …
Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google

Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google

January 9, 2020

With the WikiLeaks release of the vault7 material, the security of the UEFI (Unified Extensible Firmware Interface) firmware used in most PCs and laptops is once again a concern. UEFI is a proprietary …
Control-flow Enforcement Technology

Control-flow Enforcement Technology

January 8, 2020

Hackers often look for buffer overflow opportunities in an application and feed it illegal input data to overwrite function return addresses, combining with gadgets, manipulate normal program execut …
Struts 2, Equifax, and you: The story of the worst breach in history (sponsored by Contrast Security)

Struts 2, Equifax, and you: The story of the worst breach in history (sponsored by Contrast Security)

January 6, 2020

Arshan Dabirsiaghi explains what Contrast Security learned from the Struts 2 exploit and details how to stop the next attack against your production apps.
SETL: An efficient and predictable way to do Spark ETL

SETL: An efficient and predictable way to do Spark ETL

December 30, 2019

Common ETL jobs used for importing log data into Hadoop clusters require a considerable amount of resources, which varies based on the input size. Thiruvalluvan M G shares a set of techniquesinvolving an innovative use of Spark processing and exploiting features of Hadoop file formatsthat not only make these jobs much more efficient but also work well with fixed amounts of resources.
BoF: How Open Source Project Xen Puts Security Software Vendors Ahead of Emerging Threats

BoF: How Open Source Project Xen Puts Security Software Vendors Ahead of Emerging Threats

December 28, 2019

This presentation covers a real-world case study of Bitdefender Hypervisor Introspection (HVI) that is based on Xen Project software. On April 14th, The Shadow Brokers released the Eternalblue exploit …
Open Source Cloud Ecosystem for Next-Gen Disaggregated Datacenters

Open Source Cloud Ecosystem for Next-Gen Disaggregated Datacenters

December 24, 2019

Modern computer systems have been for long designed as monolithic blocks built around the boundaries of the motherboard. This talk looks at novel architectures for low-power and high-utilization disag …
Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google

Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google

December 19, 2019

With the WikiLeaks release of the vault7 material, the security of the UEFI (Unified Extensible Firmware Interface) firmware used in most PCs and laptops is once again a concern. UEFI is a proprietary …
How Amy, an artificial intelligence capable of scheduling meetings, understands human intents

How Amy, an artificial intelligence capable of scheduling meetings, understands human intents

December 18, 2019

Rakesh Chada introduces x.ai's Amy, an AI assistant that schedules meetings via email. Rakesh discusses Amy's architecture and the various challenges the team faced during its design and shares several machine learning approaches for intent classification. Rakesh concludes by exploring a novel method for error optimization in a conversational agent that exploits customer error tolerance.
Superhuman AI for strategic reasoning: Beating top pros in heads-up no-limit Texas holdem

Superhuman AI for strategic reasoning: Beating top pros in heads-up no-limit Texas holdem

December 18, 2019

Tuomas Sandholm offers an overview of Libratusan AI that beat a team of four top specialist pros in heads-up no-limit Texas holdem, which has 10^161 decision pointsand explains how Strategic Machine is applying the domain-independent algorithms behind Libratus to a variety of imperfect-information games.
Orchestrating chaos: Applying database research in the wild

Orchestrating chaos: Applying database research in the wild

December 14, 2019

Lineage-driven fault injection (LDFI), a novel approach to automating failure testing, can greatly reduce the number of faults that must be explored via fault injection. Peter Alvaro explores LDFIs theoretical roots in the database research notion of provenance and presents early results from the field and opportunities for near- and long-term future research.
Locking it down: A security primer for web developers

Locking it down: A security primer for web developers

December 8, 2019

Your users are almost certainly vulnerable in one way or another. Mike North explores a series of common web app security pitfalls, first demonstrating how to exploit the vulnerability and then recommending a pragmatic and effective defense against the attack. Buckle up, because Mike's about to take some things you love and depend on and smash them to bits.
Data citizenship: The next stage of data governance

Data citizenship: The next stage of data governance

December 4, 2019

Successful organizations are becoming increasingly Agile, and the autonomy and empowerment that Agile brings create new, active modes of engagement. Data governance however is still very much a centralized task that only CDOs and data owners actively care about. Antonio Alvarez and Lidia Crespo outline a more engaging and active method of data governance: data citizenship.
How knowledge graphs can help dramatically improve recommendations

How knowledge graphs can help dramatically improve recommendations

December 3, 2019

Collaborative filtering is great for recommendations, yet it suffers from the cold-start problem. New content with no views is ignored, and new users get poor recommendation. Aurlien Gron shares a solution: knowledge graphs. With a knowledge graph, you can truly understand your users' interests and make better, more relevant recommendations.
How to secure Apache Spark?

How to secure Apache Spark?

December 2, 2019

Security has been a large and growing aspect of distributed systems, specifically in the big data ecosystem, but it's an underappreciated topic within the Spark framework itself. Neelesh Srinivas Salian explains how detailed knowledge of setting up security and an awareness of what to be looking out for in terms of problems and issues can help an organization move forward in the right way.
Identifying and exploiting the keys to digital transformation

Identifying and exploiting the keys to digital transformation

December 2, 2019

Leading companies are integrating operations and analytics to make real-time adjustments to improve revenues, reduce costs, and mitigate risks. There are many aspects to digital transformation, but the timely delivery of actionable data is both a key enabler and an obstacle. Jack Norris explores how companies from Altitude Digital to Uber are transforming their businesses.
Shipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes [A]

Shipping in Pirate-Infested Waters: Practical Attack and Defense in Kubernetes [A]

December 2, 2019

Kubernetes has a growing array of security controls available, but knowing where they all fit in, what the highest priorities are, and how it all helps against real attacks is still far from obvious. …
Insecure Containers? Continuous Defense Against Open Source Exploits [A]

Insecure Containers? Continuous Defense Against Open Source Exploits [A]

November 24, 2019

Open Source Software underpins the internet and many enterprises, but has repeatedly proven itself vulnerable to accident and tampering. High impact exploits lead us to question our unreserved trust i …
How Microsoft predicts churn of cloud customers using deep learning and explains those predictions in an interpretable way

How Microsoft predicts churn of cloud customers using deep learning and explains those predictions in an interpretable way

November 5, 2019

Although deep learning has proved to be very powerful, few results are reported on its application to business-focused problems. Feng Zhu and Val Fontama explore how Microsoft built a deep learning-based churn predictive model and demonstrate how to explain the predictions using LIMEa novel algorithm published in KDD 2016to make the black box models more transparent and accessible.