Representing DeepRecce - Conferences list 2016

IRISSCERT Cyber Crime Conference – November 2016
	IRISS is Ireland’s CERT team and provides a range of services to its clients to help them defend and secure their networks and data. This annual conference is now recognised as Ireland’s premier Cyber Security event where experts on various aspects of cyber security share their thoughts and experiences. DeepRecce was represented by Dr. Grigorios Fragkos who delivered a really forward looking talk on Cyber Resilience with the interesting title: All aboard, next stop; Cyber Resilience. The talk familiarised the audience with what Cyber Resilience really is, how a holistic approach to cybersecurity problems is better to protect us from cyber threats, and last but not least, how Cyber Resilience will change once and for all the way cybersecurity is discussed in the boardroom, as it will provide companies the means to stay within budget.
BruCON – October 2016
	One of the most important security conferences for ethical hackers in Europe is BruCON. The event started with security training sessions that lasted for three days and concluded with a two-day conference composed of outstanding security presentations and workshops. It comes without surprise to see so many people arriving to the event from all over Europe to join an interesting atmosphere for open discussions related to critical InfoSec issues, privacy, information technology and its cultural/technical implications on society. DeepRecce was represented at the conference by Dr. Grigorios Fragkos who was invited to present his talk on Point of Sales (POS) and more specifically on Point of Interaction (POI) devices and Virtual Terminals. Even though the research started almost three and a half years ago, the findings were never made publicly available, and have only been presented behind closed doors and to by invitation only events/conferences, in order to be given enough time to acquirers, payment processors and affected parties to remediate the issues disclosed.
Securing Online Gaming – October 2016
	The challenges involved when it comes cyber resilience were discussed at this year’s annual “Securing Online Gaming” in London, on the 4th October 2016. DeepRecce is not only a strategic sponsor to the event, but was also represented by Dr. Grigorios Fragkos with an innovative and forward-looking talk on “Online Gaming towards Cyber Resilience”. The talk focused mainly on: • Today’s challenges & requirements towards security online gaming • How attacks are evolving, and what should we expect • Taking steps for an effective Cyber Resilience strategy
44CON – September 2016
	DeepRecce had a presence at this year’s 44CON in London. We had the chance to meet and catch up with friends and colleagues from the industry. As Cyber Security becomes a more and more boardroom discussion it was a pleasure to see the department of MoJ Digital & Technology at the event who also designed a fun yet challenging Capture the Flag. Information Security professionals from all industries, mostly interested in cybersecurity and ethical hacking, had the change to attend a series of interesting talks and workshops related to security from speakers around the world.
Security BSides Manchester – August 2016
	DSecurity BSides events are Information Security community based conferences happening all over the world and DeepRecce was present at this year’s event in Manchester. Information Security Professionals, experts, researchers, ethical hackers and InfoSec enthusiasts come together to discuss the next “big thing”, not only to ethical hacking, but instead the conference is open to a wide range of subjects related to security such as incident response, IoT security, computer forensics, security standards and of course compliance. DeepRecce was represented at the event by Dr. Grigorios Fragkos with a talk about “Accessing the personal details of most of the InfoSec professionals & the Responsible Disclosure process”. Due to the sensitive nature of the contents, the talk was not allowed to be recorded.
Electromagnetic Field – August 2016 – EMF Camp
	A UK based camping festival that takes place every two years for those with an inquisitive mind or an interest in making/breaking things: hackers, geeks, digital artists, scientists, engineers and technology enthusiasts. DeepRecce was represented at the event by Dr. Grigorios Fragkos with a talk on the myths and truths when it comes to hacking airplanes.
SnoopCon – July 2016
	DeepRecce was represented by Dr. Grigorios Fragkos at SnoopCon 2016 invited by the Cyber Security Testing and Validation Team at British Telecoms (BT) in order to attend their annual internal conference, as a guest speaker. This is actually the second time Grigorios attended this by-invitation-only conference, where he was awarded the Best External speaker award in 2015. The conference is known as SnoopCon and it is BT’s Penetration Testing and Ethical Hacking annual meet-up event which lasts five days overall.

TP-LINK Modem / Router (ADSL2+) Security and Vulnerabilities

I really hope this blog post starts a small trend when it comes to the security of home-based routers. I started searching online for home routers (SOHO) and wanted to compare them based on how secure they are, up to a reasonable price for a household. I have seen all these different makes that have been found in the recent years to contain hard-coded credentials and other known backdoors, and I wanted to investigate this a bit further. 

It is very hard to find security related information about routers before deciding which one to buy. Also, it is really annoying to see that manufacturer only care and promote the features and functionality of a router, and do not consider security at all.

From where I stand, when a company sells a router, should be in their best interest that router to have no security vulnerabilities. Otherwise, it is like having a company that wants to sell bulletproof vests that doesn't stop bullets, other than those fired from Airsoft BB guns.

I do understand that most people might choose a router based on its cost, colour, shape and if it is shiny. However, from my experience, these people just want to get online and want to simply replace the really bad modem/router their ISP provided for "free". Most of the time the real reason behind that decision is because when more than two devices are connected to those "free" devices, the Internet experience becomes annoying, to say the least. For such use, it is not hard to find a replacement for these "free" routers at a very reasonable price, and 90% of the time, it is totally worth it.

in-flight entertainment vs avionics

For those of you who have had the opportunity to see one of my presentations "Can you really hack an airplane: Myths & Truths", you are already familiar with what is really happening and the confusion between in-flight entertainment systems and avionics (https://en.wikipedia.org/wiki/Avionics). I was asked to put this article up by a number of friends in the security industry to highlight a few very important points. The purpose of this article is to provide food for thought. Especially, when you hear someone saying that "hacked" an airplane, or made it fly "sideways" by tampering with its systems through the in-flight entertainment system. Consider the following points and come to your own conclusions. 

Anyone who is trying to "generalise" and claim that during an actual flight, for example through the in-flight entertainment system, managed to take control of the plane and/or that it is possible to actually fly an aircraft like this, should first read what the law has to say about this. (Tokyo Convention 1963). 
Do you really want someone with the excuse of being a "security researcher" tampering with the airplane's systems while you are on an actual flight, because he/she decided that has nothing better to do? I am sorry, but from where I stand, we (security researchers) respect the law, and make sure we have permission to conduct any security assessments & penetration testing, in a safe and approved environment. 

IRISSCON 2016 - 8th IRISSCERT Cyber Crime Conference

IRISSCON 2016 - The 8th #IRISSCERT Cyber Crime Conference
Ireland's first CERT (Computer Emergency Response Team)

This year, my talk was all about Cyber Resilience. The talk provided the opportunity to participants to familiarise and understand what the term really means, and why it should not be considered as another buzzword used in the industry.  

"Threats constantly evolve based on the way our defences counter-evolve, and this cycle is something that is going to happen no matter what. What matters the most, is in what way we act upon, and how our decisions need to be part of a bigger forward looking strategy that does not treat security in an ad-hoc manner, especially when it is too late"

IRISSCON 2016 - IRISSCERT

The 8th IRISSCERT Cyber Crime Conference will be held this year on Thursday the 24th of November 2016 in the Ballsbridge, Pembroke Road, Dublin. www.iriss.ie 

This all day conference, focuses on providing attendees with an overview of the current cyber-threats throughout the world and focuses especially on threats that affect businesses in Ireland, and what should be the best course of action when it comes to defending against these threats. You can find my recap blog post for last year's event here.

Like every year, professionals that work in cybersecurity and tackle cybercrime / cyber threats on a daily basis, will be sharing their thoughts and experiences, while attendees have a unique opportunity to ask questions,discuss cybersecurity strategies, and most importantly will meet and network with likeminded individuals allowing them to share their views and opinions.

I am honoured to be invited to speak at this event and get to share my thoughts and views on cybersecurity and most importantly, on cyber resilience, which is also reflected by my talk's title: "All aboard, next stop; Cyber Resilience". 

The abstract for my talk can be found below and I do hope you find it interesting. If you find yourselves in Dublin during the conference, I strongly suggest getting a ticket on time and join us at IRISSCON, and please come and say hi. It is always a pleasure to meet people who are passionate about information security and cybersecurity, and want to discuss/share their thoughts and opinions. Looking forwards to seeing you all there.

BruCON 2016 (0x08) - Speaking about POS, POI & VT (the undisclosed talk)

It was a great honour for me to present this year at a hacking conference like BruCON (brucon.org). 

As many of you already know, I started this because I wanted to know how the payment process works behind the scenes (Payment Card Industry - PCI) and how secure these systems are, which we take for granted on a daily basis. 

After researching Point-of-Sales (POS), Point-of-Interaction (POI) devices and Virtual Terminals (VT) for almost 4 years, it was about time to do a presentation that wouldn't be behind closed doors as I usually do. I talked with a number of acquires, issuers, payments processors and POI OS manufacturers and let them know about my findings way before this talk. 

Parrot AR.Drone 2.0 Power Edition (How to)

I recently got a Parrot AR.Drone 2.0 Power Edition and I had a few issues with setting things up and running. After researching on the Internet many others had similar issues and a number of opinions and solutions were being suggest but without definitive answers. 

Due to the fact I had to spend a lot of time trying to find out who is right and who is wrong on the forums, I decided to make this non-security related blog-post because I believe it will really help a lot of people when it comes to that particular drone.

How to employ talents in the security industry

There are so many things to say on this subject, that it is really difficult for me to decide where I should start. I do not want to create a very long post, so, I will try to keep this brief and to the point. I will not try to explain each point in more detail because it wouldn't be much of a help at this stage, but I will try to give a few pointers on why it is currently considered a very challenging task for companies to employ talents.

Even thought this is not an article for talents in the music industry, I have included the following video for you all to see. Believe me when I say, everything will make sense by the time you read through the article.

(In case you cannot see the embedded video: https://youtu.be/_xj1ncF5hSY)

Again, before you read any further, keep in mind that everything I am writing here is about the process of: identifying and employing talents, and more specifically talents in information security and information technology, and especially those that have a 'growth mindset'. (I will talk about the 'growth mindset' at a different post).

When you find a job opening online, it is most likely to have been written/revised by the HR department based on what is currently being asked for this role, based on similar job opportunities on the Internet. You can actually spot such job openings by looking at the requirements and see that they ask for “a little bit of everything” that does not really make a lot of sense. If you are the person tasked with the responsibility to hire someone and you try to modify the HR’s “template/process” to suit the particular needs of this new job opening, good luck.

You are going to end up filling-in forms and forms, that do not ask the right questions on what you are trying to achieve, it is almost impossible to deviate from the HR’s template and at the end of the day after spending time on this, the HR will have the final say on what will be the final form of the job opening. On top, in most organisation the shortlisting phase is done by HR staff who in reality have no real understanding of what is your skillset for the particular job other than cross-checking the preset requirements in the job post. Hiring talents requires you as an organisation to rethink the whole process and ensure it actually invites talents to apply for the job openings your company has.

Talents do not fit in job descriptions. A talent does not live under a title saying I am a penetration tester, a security consultant, a security architect, etc. With talents, it works the other way around. They just know things (love to keep learning things) or they are really good on things that they do not know how good they are. They can combine information they already know to find solutions, they know how to solve problems, they have ideas, they think in a different way than other people do. Instead of trying to fit them in a job description, look behind the curtain and read between the lines during the selection process and the interview. Allow them to tell you what they can do for the company, and the role they are interested in.

Most of the time, the shortlisting process simply excludes talents from getting into an interview. Imagine you are the talent and you have to spend almost two-three hours of your time, trying to put your CV in an online web application, that asks you questions completely irrelevant, because it was meant to be generic. For example, when you are planning to hire a developer who is a talent, you want someone who really knows how to write code, who knows how to solve an algorithmic challenge because he/she takes pride on that, someone who is not going to reuse a solution from “stackoverflow” that has no idea how or why it seems to be working. These qualities cannot be put in a job description, cannot be highlighted in the automated shortlisting process. These qualities can only be identified during the interview when the person (talent) has a chance to answer the right questions.

The interview is the most important stage of the whole process. Let’s assume that the person being interviewed (who is a brilliant candidate and the talent the company is looking for) managed to overcome the aforementioned problems and got shortlisted for an interview (face-to-face or otherwise). The candidate, has now to face four major problems.

• The person conducting the interview is not trained or suitable for conducting interviews in general. Some of the people tasked to do this, they either do not like it, or they are really bad at it (even after training). The interview ends up being a great opportunity for people who know how or willing to “charm” the interviewer, and tell him/her what exactly he/she expects to hear. A talent is not there to charm anyone and play sympathy games. A talent expects to be respected as a person, valued for what he/she knows, demonstrate how eager he/she is to learn, what he/she can offer in this role and to be asked the right questions.
  
  
• It is true that talents might have awkward personalities but this is part of what makes them special and so good in what they do. Consequently, the interviewer not only needs to be really good at interviewing people but also needs to be able to read between the lines. Not all people are comfortable talking about themselves, or go into an interview with the right attitude, or reply to the questions like superstars, or say something catchy. Sorry to break it to you, but if this is what you want to see in an interview, then you are looking for a "used car salesman", not a talent. Allow people time to feel comfortable and open up slowly. If they cannot talk about themselves, ask things about them and they will tell you (their answers might be brief sometimes, and your role is to help them elaborate on them). There are occasions where the interviewee replies to a question with something brilliant or something the interviewer is not familiar with. Instead of having an empty expression on your face and try to change the subject, think about allowing the talent to elaborate on this. We all learn a new thing every day, and your pride won’t be hurt if you listen carefully for a change.
  
  
• The almighty checklist of standardised questions and the tick in a box. Don’t do me wrong, having a checklist of questions that need/should be asked is fine, but make sure you are asking the right questions. Seriously, what is the purpose of the question “can you tell me the OWASP Top 10 by heart”. Such questions simply are asked to make the interviewer fill superior (establish his/her dominance in the room) and the interviewee to feel that he is not in charge (despite how "well" you respond to the question). Include questions that allow the interviewee to elaborate on his/her experiences and thought process (how do deal with problems, suggesting alternative solutions, investigating issues, proposing new project ideas, etc.), and not tricky/sneaky questions with a double meaning that he/she cannot think about at that particular moment mostly due to the stress of the interview. Also, make sure you took the time to read the CV (resume, for my US friends) of the person you are interviewing and allow him/her to tell you if they have done some amazing things (projects), and which are these (and how did they come up with the idea and why). Telling/Admitting to the interviewee that you haven’t read his/her CV before entering the room and conducting the interview, from where I stand, is simply unacceptable and you should not be conducting the interview (any interviews in general). If you haven't spend at least ten minutes to read through the submitted CV/Resume prior to the interview and highlight the thinks you would like the interviewee to elaborate upon, then clearly you are not interested in finding a talent for the company (and this lack of interest in finding a talent is currently being interpreted by many companies as a shortage of talents). You are simply wasting your time just to get away from work for an hour or so, wasting the interviewee's time and you just want another tick in a box saying that you conducted an interview.
  
  
• The interviewee can do nothing about his/her future “team-mates” feeling threatened by the fact the company is about to hire the talent they were looking for, for so long. It is not uncommon for the first interview to be conducted by the person who is supposed to become your future boss. This is actually really good as you get a vibe of the person in charge and he/she gets an opportunity to get to know you (and explain what he/she is looking for to bring in the team, the real need, not simple a generic job description). Imagine now the case where the talent nails that interview and his/her future boss is really impressed. So impressed, the candidate is asked to stay and do the second interview on the same day and get things going as fast as possible. Sometimes, that second interview is given to someone the candidate will end up working with, which is usually considered to be the “number two” guy on the team. As we are only human, there have been cases where the interviewer felt like he/she is not going to be the “number two” for much longer, because the candidate is really a talent. In that case, the almost future boss ends up getting a disappointing report / feedback from his/her “number two”, saying that the candidate failed the technical part of the interview. In one occasion, believe it or not, the guys conducting the second interview said this to each other after the interview: "This person is brilliant, has everything the team needs and what the company is actually looking for at the moment. However, if we decide to recommend this person, he/she will be able to everything (every task) we assign him/her to do without any problems or training. I am afraid he/she will be able to demonstrate that he/she can do both of our jobs within two-three months time".

Last but not least, asking the right questions. It was mentioned a few times during the article on purpose. First of all, keep in mind that is a lot easier for talents to identify talents in their particular area of expertise (I am not referring only to people with technical skills here). There is no point asking questions that anyone can answer using a search engine by simply clicking on the “I’m feeling lucky” option. Talents are being identified

  a) by their achievements (up to that point in time),

  b) the reason(s) why they did things in a certain way to solve a problem,

  c) the way they challenge themselves on a daily basis and 

  d) what challenging projects they have completed successfully,

  e) their particular and unique thought process,

  f) their out-of-the-box thinking and novel ideas, etc.

Ensure the questions being asked reflect upon these qualities. Allow the questions to take twists and turns, be flexible based on the personality and background of the person being interviewed, allow the questions to be scalable and progress slowly towards the right direction, elaborate and engage with the candidate in order to reveal the hidden diamond behind the sometimes, rough surface.

Based on the alluded, and assuming that you took the time to watch the embedded video, consider a job opening in the music industry where a record company wants to put together a band. Imagine now this record company interviewing for bands the way the Information Security industry conducts interviews for talents (automated short-listing process, narrow and irrelevant questions, interviews that do not allow you to demonstrate your talent(s) but reply to standardise checklists, etc). Just image the questions:

Q: What instruments each member of the band knows to play? A: None

Q: Do you sing? A: Well, this guy does, there rest of us make noises.

Q: Can you dance? A: No, we just sit on stools most of the time.

and so on... 

I would like to assume that you are now getting where I am going with this and I really hope you enjoyed reading this post (and the metaphor). I am considering making a proper presentation on the subject with more details and examples.

(This blog post was also posted here: https://www.peerlyst.com/posts/how-to-employ-talents-in-the-security-industry-grigorios-fragkos )

IP EXPO EUROPE 2016 (..and winning a drone)

I had the opportunity to be at IP EXPO last week, in London. For those of you who are not familiar with the event, IP EXPO Europe took place at ExCel London (5-6 October 2016). 

The interesting fact about IP Expo is that you can find vendors and services across the whole spectrum related to IT. More specifically, under one roof you will find anything you need related to Cloud and Cloud services, Cyber Security, network and infrastructure solutions, data analytics, DevOps, and Open Source. 

Compared to InfoSecurity Europe, it is a smaller event but this ended up being good. The exhibitors had a standard booth size allocation and it was much easier to get around, talk to people and faster to find what you were looking for. Maybe it made more sense this particular layout to my OCD I guess. 

Towards a Cyber Resilience strategy (Cyber Security Awareness Month – Oct 2016)

As most of you already know, October is Cyber Security awareness month. The aim of the Cyber Security awareness month is to raise awareness across the international community about cyber threats, discuss best practices, and educate the public and private sector, on how to stay safe online.

Cyber Security is promoted extensively during this month and many events are being organized with the sole purpose to engage and educate public and private sector entities, while provide them with the necessary tools and resource to stay safe when connected online. Given the opportunity let’s talk about the UK’s Cyber Security Clusters and how you could get to engage, participate, network and most importantly ask any questions that you currently have regarding your organizations cyber security posture and staying safe online.

New laptop with a noisy (annoying) fan

I will keep this short. If you bought a new laptop (it can happen for desktop computers as well) and the manufacturer did not make sure the fan is completely silent (and you really want to punch them in the face because it is not 1998) then I suggest:

a) check if there is a firmware update for your laptop (sometimes there is and it fixes many issues)
b) you download this little utility before you start breaking things around the house and see if it works for your make/model. 

https://github.com/hirschmann/nbfc/releases 

(at the time of writing this blog post the version of the utility was 1.4.2)

Hope this helps, but make sure you keep an eye on your temperatures via an utility like HWmonitor to make sure the cooling still works properly. 

Securing Online Gaming 2016

The challenge of continuous security are going to be discussed at this year's annual "Securing Online Gaming" in London, on the 4th October 2016. It is a great to be among such amazing speakers and have the opportunity to speak about the challenges of securing online gaming. 

I will be representing DeepRecce which already has a leading role in the market when it comes to its cyber security solutions and its under 15 minutes deployable managed SOC solution across any number of hosts. 

My talk will discuss Online Gaming towards Cyber Resilience, and more specifically it will focus on:

• Today's challenges & requirements towards security online gaming
• How attacks are evolving, and what should we expect
• Taking steps for an effective Cyber Resilience strategy

The event will take place near the St. Paul's Cathedral and The Barbican. This is directly opposite the Museum of London. Located at 200 Aldersgate etc.venues St Paul's is a state of the art conference centre with the largest room holding up to 400 along with a further 12 rooms for conference breakouts, training and meetings.

44CON 2016

Another year, another 44CON in London. A line-up of great talks, and a very good opportunity to catch-up with friends from the industry. The event took place between 16-18/Sep 2016, at the ILEC Conference Centre. 

This year you were able to solder your badge while you were there. There was a nice corner dedicated to soldering, with solder irons provided and all the bits to make it work. 

I ended up making six of those in order to help out a couple of friends. It was really easy to make and really fun to do, especially when it started working as it should. 

The badge is called HIDIOT and it is short for HID IO Toolkit. :) The Human Interface Device Input/Output Toolkit (HIDIOT) is a USB-based board for manipulating and experimenting with USB HID class devices. The version given out at 44CON is unreleased. In effect, we decided to make our badge a piece of 0day hardware.

How to train your facebook ads..

Most of you use Ad Blockers and I am happy that you do for all sort of reasons, which I will not discuss here. This blog post is about how you can train the ads you get on different websites (mostly on social media) based on what you care less. Yes, that is right. If you really want to avoid being distrusted or even tempted from clicking on (sometimes malicious) ad links, then what is better than training the system behind the scenes to show you ads only on things that you really don't care about at all. :D

I will use the example of Facebook, which I have been doing for a long time and I realised just know that I haven't actually shared this with you all. 

What you see on the left hand side is a print screen from the ads I get on Facebook. Those side ads are not a problem due to way they are being displayed but, based on these ads, you get similar ads in your news feed as well. 

Thus, by training these ads, you will get relevant ads in your news feed as well. As you can see on your left, all the ads I get are about sports and sometimes about music. 

The reason is because I DO NOT CARE AT ALL about sports, or what is happening in the music industry. 

When you click to hide an ad, Facebook asks you the following:

 Why did you hide it?

 - I don't care about this

 - I keep seeing this

 - It's offensive or inappropriate 

 - Other

 - I want to see something else

When you are presented with these options, you just need to use them in a clever way. Anything that seems like you would be interested, lets say politics, environment, science, space exploration, ninjas, you select any on the options that classify it as "something you don't care". 

On the contrary, when you get ads that you really never cared about, such as sports, or gambling, you keep leaving these ads in your feed like it really matters to you. 

Doing that 3-4 times in a day, for a couple of days, trains the engine behind Facebook and starts displaying ads that you don't really care. 

Actually, our brains learn to ignore ads after a while, but when the content is irrelevant to your liking, your brain ignores them completely. I know it sounds weird, but you will end up going through your news feed and your brain will keep ignoring the ads. Especially ads that you don't care about, in such a way that you won't ever remember seeing the targeted add. Trust me and try it! ;)

Security BSides Manchester 2016

Thank you all for coming to my talk at Security BSides Manchester 2016. The conference took place on Thursday 18th August 2016, at Manchester Metropolitan University Business School, in the heart of Manchester.

The title of my talk was: 

Accessing the personal details of most of the InfoSec professionals & the Responsible Disclosure process.

The talk was not recorded due to the sensitive nature of the content and not much information was given in the abstract. 

Electromagnetic Field 2016 - EMF Camp

Electromagnetic Field [1] is a UK camping festival for those with an inquisitive mind or an interest in making things: hackers, artists, geeks, crafters, scientists, and engineers.

This year's badges were amazing! If you want to start hacking your badge, go to this link: https://badge.emfcamp.org/wiki/TiLDA_MK3

I actually had the opportunity to give a talk on the myths and truths when it comes to hacking airplanes. Thank you all for coming to my talk! The talk was recorded and streamed live at the same time. Soon, the video will be available on EMFcamp's youtube channel if you would like to watch.

This year the event took place between Fri 5th - Sun 7th Aug 2016. The organisers found a really nice location outside Guildford. It is an awesome camping site with power to your tent (if you remembered to bring an extension) and Internet access. Tickets are approximately £120 and if you are thinking of driving down, you need to purchase in advance a parking ticket. If you have a motor-home, you are also welcome. 

EMFcamp welcomes everyone, supports diversity and does not tolerate misconduct. So, pack your tent, some warm clothes, a couple bottles of/for water, a torch, your favourite drinks and you are all set. I suggest you get earplugs as well, especially if it is windy, you wont be able to sleep. 

Plenty of presentations to watch, a few canteens with drinks and food, and many different workshops. Many different villages [2] and a lot of fun stuff to do all day long! Except from attending interesting talks and workshops, from hacking stuff, making stuff, creating music through algorithms, practising your soldering skills, lock-picking, talking to people around the world through radio broadcast, and play fire ping pong, you can also enjoy the day with all sort of people, make new friends while have a a cold drink and warm food.

There is also a kids area as well where you can let them play from 10:00 am until 20:00 pm and overseen by professional carers. 

Pick your favourite activity as you go along or plan your day in advance by looking at the schedule on the website. 

You can follow EMF camp on twitter: @emfcamp 

[1] https://www.emfcamp.org
[2] map.emfcamp.org

0x Haxors - Deck of Playing Cards (hexadecimal)

Ever wanted a #geek version of a deck of playing cards based on the #hexadecimal numeral system (68 cards)? At last, a deck of playing cards based on the hexadecimal numeral system, also known as HEX. (meaning this is a custom-made deck that has 68 cards, not the 52 standard deck). ..check this Kickstarter project out!

Then you should check this out: 

https://www.kickstarter.com/projects/gfragkos/0x-haxors-deck-of-playing-cards 

This project in order to be completed needs to place an order for a custom design (graphics included) and a custom cut for these cards. All existing playing-cards printing facilities (patterns) are made to print the normal 52 cards deck and in this case we need way more: 68 custom high quality prints and cuts. (special packaging for each deck is needed as well)

Thus, by backing this project you will help with the significant cost of placing a custom order for designing and printing this special set of cards. 
We are aiming to make the cards high quality in order to last longer when you play.

So, to summarise: 
Please note that making a deck or 68 cards, instead of the standard 52 cards, it means that even the packaging is custom-made and the cost involved is WAY HIGHER that simply changing the drawing on a standard 52 cards deck.

• Graphics (by a professional graphic designer). 
• High Quality print 
• Quality cards with clear plastic coating to last longer and fill nicer (than paper cards). 
• We want them to be water resistant as well. 
• Special Order to print 68 cards for each deck. 
• Packaging design and making to fit 68 cards. (packaging need to be custom made) 
• Staff costs to pack all these decks and ship them worldwide.

Please, help this project to become a reality!

SnoopCon 2016

I had the honour to be invited again this year by the Cyber Security Testing and Validation Team at British Telecoms (BT) in order to attend their annual internal conference, as a guest speaker. The conference is known as SnoopCon and it is BT’s Penetration Testing and Ethical Hacking annual meet-up event which lasts five days.

The event is held behind closed doors, however it is customary that on the third day they invite people from the industry, recognising that their work would be an invaluable input if presented at their internal conference.

It was a great opportunity for me to catch-up with so many friends at SnoopCon. I also find out that Anoop Sethi has decided to retire after approximately 12302 days uptime (33 years) for BT. 

It is a great honour to have known Anoop, the man who fundamentally changed the way Security and Penetration Testing is viewed in BT. Given the opportunity, I would like to personally wish Anoop all the best with anything he decides to do and I would like to thank him for being such an amazing individual.

I had a fantastic day at BT and the quality of the guest talks was over the roof. I am going to outline here briefly the content of the talks in the order they were presented. 

Invitation to the largest European Cyber Security Challenge

ENISA (European Union Agency for Network and Information Security) is organising the European Cyber Security Challenge 2016 - the largest European challenge for cyber security talent. The Challenge will be held in November in Dusseldorf, Germany - and the Greek National Cyber Security team will compete with other national teams in various security-related challenges, such as web security, mobile security, crypto puzzles, reverse engineering, forensics.

The Greek team will be assembled in a qualifying round - in which we'd like to invite you to participate!

The qualifier will be held on Saturday, July 9 at the Department of Digital Systems of the University of Piraeus. The challenges will be similar to the ones outlined above, and the top 10 participants will comprise the Greek team that will travel to Germany. In order to be eligible, contestants need to legally reside in the country, be aged between 14-30, not have a Master's or higher degree or any professional experience in the information security sector - and of course have some InfoSec skills! Both competitions will be held in English, so contestants need to have at least basic understanding of the English language.

The Greek team is organised by TwelveSec and the Department of Digital Systems of the University of Piraeus, and supported by other major Greek universities and organisations, such as Security BSides Athens.

All you need to do to get the chance to compete in the qualifier is to register in the official website of the Greek team http://ecsc.gr/

Registrations are closing this week (Friday, July 1), so hurry up and register!

Security BSides Athens 2016

It has been a while since my last blog-post and the main reason for that, was the numerous things I had to keep track for organising:

Security BSides Athens 2016 (www.bsidesath.gr) 

It has been a very busy year trying to organise this Security BSides event for the first time in Athens, Greece, with plenty of “hiccups” to overcome in the meantime. 

Once we had a team of people who were equally excited and passionate about this, we started working towards the event details.  

---

Given the opportunity, I would like to personally thank the team once again, all the volunteers who helped out on the day, the review committee who provided constructive feedback to all submissions, the speakers who travelled from all over the world to be there and present, and last but not least, all of YOU who attended the event. 

Special thanks goes to our sponsors, who trusted us on our promise to deliver this information security community based conference. We couldn't be able to bring this event to Athens, especially for the first time if it wasn’t for them, and for that we really appreciate their contribution and support.

Of course, such an event would not be able to exist without the community support we had from fellow conferences all over Europe, the Universities that promoted the conference, the Hellenic Army General Staff, and all the people how were involved and made this event a success story. 

We had some great feedback already and we are committed to tweak things according to the recommendations and suggestions we received in order to make the event next year even better. There is always room for improvement and for more people to get involved. 

Ransomware - Did you update your incident response plan?

At the beginning of 2016 an article was published about the increasing threat of ransomware and provided advice on having an incident response plan that is ready to face this emerging threat. Our article focused on tips related to prevention, response and evading extortion. If you did not have a chance to read our article from January, we recommend that you read it as soon as possible.

Now, at the end of the first quarter of 2016, it is evident that ransomware has become a headache for those who did not take all the necessary precautions to avoid being the next target. Recently, the FBI released a statement to The Wall Street Journal that ransomware is a prevalent and increasing threat. As this recent article describes, attackers are trying new approaches to infection, such as ransomware ‘malvertising’, and have succeeded in creating the first Mac OS X ransomware.

Have a plan, Be Prepared
Due to the fact that it is not easy to deal with the situation after an organisation is hit by ransomware, the best course of action is to ensure there is a backup plan in place. It might come as a surprise but in order to understand the seriousness of the situation, consider that an official in the FBI’s Boston field office went against normal FBI policy and suggested to a conference audience that often the only solution is to pay the ransom. Sysnet wants to make sure you do not have to face that moral dilemma and for that reason we are trying to inform you about the increasing threat and ensure you have taken all the necessary steps towards prevention.

The Badlock day has arrived!

Badlock is a a crucial security bug in Windows and Samba. Samba 4.4.2, 4.3.8 and 4.2.11 Security Releases are available [here]. 

Microsoft and the Samba Team have been working together in order to get this problem fixed and for a patch to be released. You will have to update your systems as this security flaw is expected to be actively exploited soon enough. 

Badlock is referenced by CVE-2016-2118 (SAMR and LSA man in the middle attacks possible).

There are additional CVEs related to Badlock. Those are:

• CVE-2015-5370 (Multiple errors in DCE-RPC code)
• CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP)
• CVE-2016-2111 (NETLOGON Spoofing Vulnerability)
• CVE-2016-2112 (LDAP client and server don't enforce integrity)
• CVE-2016-2113 (Missing TLS certificate validation)
• CVE-2016-2114 ("server signing = mandatory" not enforced)
• CVE-2016-2115 (SMB IPC traffic is not integrity protected)

Please, find more information about badlock at the dedicated website created for that reason: badlock.org

Start Google Chrome in Incognito Mode by Default

I tend to use different browsers for different tasks, and that makes my life a lot easier when it comes to managing all the different things I have to do. From my point of view, the Google Chrome web browser is the ideal browser for its incognito mode when accessing known safe websites. 

In order to speed things up, I tend to start it in incognito mode by default. Not many people know this, but it is really easy to start Chrome in incognito mode by default. 

If you already have Chrome already installed, locate the executable on  your system. You can R-Click on your existing shortcut (i.e. on the Start menu) and choose, "Open file location". 

Building a Security Operations Centre (SOC)

Building a Security Operations Centre (SOC) is undoubtedly the best move you can make towards protecting not only your organisation’s data, systems and services, but also any sensitive information about your clients that you handle or store. This article is a brief overview of the task of building a SOC, introducing not only the key elements but also how the challenges of increased security requirements and rapid response are addressed.

The process for building a SOC can be time consuming and it is directly related to the available budget. The best approach is to create a plan that allows for incremental phases of implementation. Starting with a gap analysis, you will be able to define and prioritise the milestones for incremental improvements by setting the appropriate expectations and timelines. To start with, take a look at the Centre for the Protection of National Infrastructure (CPNI) and more specifically the Top 20 Critical Security Controls guidance.

The incremental improvements need to take under consideration the collaboration and communication between people, technology, and processes. These are the three equally important components that define a SOC.

Format a memory card back to its original size

After using an SD card to install Kali Linux on Raspberry Pi, I decided I had to reformat it to its original size. If you try to do this using the format tool on Windows you won't be able to format your card. 

The best way to do this, if you want to use Windows, is to start the command prompt and use the diskpart command line tool. Insert your memory card and follow the instructions below.

Start the command prompt and run the command: diskpart

This will open up a new command prompt window similar to the following screen.

Raspberry Pi 2 Model B and Kali Linux 2.1 - quick setup

In order to install Kali Linux on Raspberry Pi, you will need to download the new image for Raspberry Pi 2 version 2.1 from https://www.offensive-security.com/kali-linux-arm-images/ (filename: kali-2.1-rpi2.img.xz). 

Many people want to play around with this combination of a Raspberry Pi and Kali Linux, but they do not want to waste any time figuring out why something is not working as it should. This quick setup guide is structured in a way that will allow you to streamline the process and make sure you have your Raspberry Pi up and running within a few minutes. 

[Extraction]
The .xz extension (for more info on xz see: http://tukaani.org/xz/) means that the image file is compressed and needs to be extracted. You can download the xz utilities using the command: apt-get install xz-utils 

Under Linux, in order to decompress the file you can use the command:
unxz filename.any.xz or the command xz -d filename.any.xz 

Since version 9.04 the package p7zip manages xz files and can extract them using the command: 7za e filename.any.xz