attack

Trusted AI

Trusted AI

March 4, 2020

Artificial Intelligence plays an increasingly significant role in our life. It is enabling humans to reach what was once regarded as pure sci-fi, deeply impacting all areas of development. AI systems …
Defeating Cisco Trust Anchor: A Case-Study of Recent Advancements in Direct FPGA Bitstream Manipulation

Defeating Cisco Trust Anchor: A Case-Study of Recent Advancements in Direct FPGA Bitstream Manipulation

March 2, 2020

In the space of trusted computing, FPGA-based security modules have appeared in a number of widely used security conscious devices. The Cisco Trust Anchor module ( …
Lightning Talk: DNS Transparency Project

Lightning Talk: DNS Transparency Project

March 1, 2020

Recent attacks on the DNS, such as those detailed in Cisco Talos' report "Sea Turtle", expose a critical lack of visibility / audit trail within the DNS hierarchy. …
Practical Solutions for Amplification Attacks

Practical Solutions for Amplification Attacks

February 29, 2020

We review the growth of DDoS attacks over the past decade, with a focus on how they're generated. We then show practical methods for tracing the origin of amplific …
BGP Route Security - Cycling to the Future!

BGP Route Security - Cycling to the Future!

February 28, 2020

The BGP routing protocol was designed to control traffic at interdomain routing level, but Its scalability and extensibility made it popular in other environments: …
DNSSEC. What it is and what it isn't.

DNSSEC. What it is and what it isn't.

February 28, 2020

DNS hijacking has become a mainstream technique for subverting websites, stealing login credentials, fraud and abuse. The DNS is a complex system with many attack …
DDoS Mitigation Fundamentals

DDoS Mitigation Fundamentals

February 27, 2020

In this tutorial the attendees will go over the basics of Denial of Service. It starts with coverage of the different parts of the stack that can be attacked and t …
Lightning Talk: BGP on the edge: making the internet withstand extreme weather events.

Lightning Talk: BGP on the edge: making the internet withstand extreme weather events.

February 27, 2020

Flooding, hurricanes, tornadoes, fires and other severe weather/environmental events can dramatically impact our ability to deliver IP based communications to end …
Broken Fingers: A Deep Dive Into Open Source Fingerprint Authentication and its Security Issues

Broken Fingers: A Deep Dive Into Open Source Fingerprint Authentication and its Security Issues

February 26, 2020

Biometric authentication provides distinguished advantages over other techniques such as password-based ones; Biometric information is always with and unique to an individual, and hardly forgeable. On …
Next Gen Blackholing to Counter DDoS

Next Gen Blackholing to Counter DDoS

February 26, 2020

Network attacks, including Distributed Denial-of-Service (DDoS), continuously increase in terms of bandwidth along with damage (recent attacks exceed 1.7 Tbps) and …
Prioritizing trust while creating applications

Prioritizing trust while creating applications

February 26, 2020

Time and money are generally the resources we focus on when building applications. Yet we cant buy trust; it builds slowly and can be broken quickly when we dont factor it in to our development process. Jennifer Davis examines how to leverage security practices to enable an all-team approach to security.
Better routing security through concerted action

Better routing security through concerted action

February 25, 2020

There is nearly universal agreement that the Internet routing system is vulnerable to attack, but thoughts on how to address the problem vary from better technolog …
Four years of breaking HTTPS with BGP hijacking

Four years of breaking HTTPS with BGP hijacking

February 25, 2020

During the 2015 BlackHat conference, the authors presented an approach which makes it possible for an arbitrary attacker to use vulnerabilities in the Border Gatew …
eBGP Flowspec Peering for DDoS Mitigation

eBGP Flowspec Peering for DDoS Mitigation

February 24, 2020

DDoS Peering has been talked about a lot in theory but it's high time we started actual implementation. This talk intends to explain the proof of concept, we have …
Getting a Good Nights Sleep After a Fresh Kubernetes Deployment

Getting a Good Nights Sleep After a Fresh Kubernetes Deployment

February 21, 2020

WIth constantly increasing number of security threats, no Kubernetes cluster should stay vulnerable. How easy it is to make sure yours follows all of the best practices? Having an automated assessment …
Cutting Edge Toolchain (Latest Features in GCC/GLIBC)

Cutting Edge Toolchain (Latest Features in GCC/GLIBC)

February 19, 2020

Toolchain technology is a day to day tool used by Linux developers. The core system of this technology is released every year (GLIBC twice a year). However, what new technology is being implemented on …
10 years building an open source community in Asia

10 years building an open source community in Asia

February 2, 2020

Sustainability is always a big question for many open source projects. Limited resources, undefined culture, lack of a common goal or vision, lack of maintainers, no backup, poor documentations, and internal conflicts are some of the challenges that prevent open source projects from growing. Hong Phuc Dang tells the story of how FOSSASIA's projects and community are grown and sustained.
Verifying Device Identity with TPMs

Verifying Device Identity with TPMs

February 2, 2020

There are many cases where you'd like to know exactly which computer you're talking to. Sometimes it's because you're SSHing to a remote machine and you'd like to verify your connection isn't being in …
Integrating security into modern software development: A workflow study

Integrating security into modern software development: A workflow study

January 28, 2020

Application security testing has been around for a long time, yet successful attacks continue despite significant investments in application security. Shift left isnt enough for modern software development that needs integrated and automated continuous security testing. Lucas Charles looks at three key considerations to get you there.
The 'S' in IoT stands for Security

The 'S' in IoT stands for Security

January 26, 2020

IoT security isn't rocket surgery, but a race to market has left a proliferation of insecure, unpatchable devices strewn across the internet. Well-established software delivery and security best pract …
Core-Scheduling for Virtualization: Where are We? (If We Want It!)

Core-Scheduling for Virtualization: Where are We? (If We Want It!)

January 14, 2020

Clever scheduling of virtual CPUs on Symmetric MultiThreaded systems for, among other things, making highly impractical side-channel attacks even more unpractical, is no new idea. Unfortunately, via e …
Under Lock & Key: Using Hardware Protected Keys with the Linux Crypto API

Under Lock & Key: Using Hardware Protected Keys with the Linux Crypto API

January 14, 2020

The Linux Crypto API which provides potentially hardware accelerated cryptographic services to the Linux kernel and user space programs running under it, has a little known but extremely useful featur …
Evaluating cybersecurity defenses with a data science approach

Evaluating cybersecurity defenses with a data science approach

January 12, 2020

Cybersecurity analysts are under siege to keep pace with the ever-changing threat landscape. The analysts are overworked as they are bombarded with and burned out by the sheer number of alerts that they must carefully investigate. Brennan Lodge and Jay Kesavan explain how to use a data science model for alert evaluations to empower your cybersecurity analysts.
Security 101 for Cloud-native Applications

Security 101 for Cloud-native Applications

January 12, 2020

Cloud native applications rely on a more dynamic operational environment that can introduce new security challenges. While most developers are familiar with traditional application security vulnerabil …
Can Artificial Intelligence Secure Your Infrastructure?

Can Artificial Intelligence Secure Your Infrastructure?

January 8, 2020

While intrusion detection systems are the basis of every security aware organization and most of the network based threats have been successfully mitigated in the past; it has a major drawback. And th …
How Secure is Your Edge with EdgeX?

How Secure is Your Edge with EdgeX?

January 8, 2020

IoT presents a large attack surface, stemming from the number of connected components, physical distribution, and bugs in hardware and software. In this talk we focus on the Edge, systems close to the …
Applications of mixed effects random forests

Applications of mixed effects random forests

December 27, 2019

Clustered data is all around us. The best way to attack it? Mixed effect models. Sourav Dey explains how the mixed effects random forests (MERF) model and Python package marries the world of classical mixed effect modeling with modern machine learning algorithms and shows how it can be extended to be used with other advanced modeling techniques like gradient boosting machines and deep learning.
Interpretable and resilient AI for financial services

Interpretable and resilient AI for financial services

December 23, 2019

Financial services are increasingly deploying AI services for a wide range of applications, such as identifying fraud and financial crimes. Such deployment requires models to be interpretable, explainable, and resilient to adversarial attacksregulatory requirements prohibit black-box machine learning models. Jari Koister shares tools and infrastructure has developed to support these needs.