News
15 countries will clash at Standoff 15, a white hat hacker showdown with a $50,000 prize pool
The Standoff 15 international cyberbattle will take place at the Luzhniki sports complex during the Positive Hack Days cyberfestival on May 21–24. Over 40 teams of attackers and defenders from 15 countries across Europe, the CIS, Southeast Asia, and the Middle East will clash in a major cybersecurity showdown. The top red teams in this cyberbattle will split a $50,000 prize pool. Blue teams will investigate live hacker attacks and defend industries, putting their skills to the test in the real world. Russia's Ministry of Digital Development is backing the Positive Hack Days cybersecurity festival. The City of Moscow is our strategic partner. This year's festival is powered by the Social Development Complex, the Department of Information Technology, and the Department of Entrepreneurship and Innovative Development. Cyberbattle participants will attack and defend the infrastructure of a virtual state. It covers seven key industries: metals, energy, oil and gas, banking, urban environment, aviation, and logistics. Each segment will have its own physical mockups and a revamped visualization system, so visitors can witness firsthand the fallout of successful attacks: streetlights going dark, flight delays, fuel shortages from a refinery meltdown, banking app crashes, even a steam turbine grinding to a halt at a power plant. This year, we'll see locally customized Linux domains powering oil and energy infrastructure, while the banking sector will adopt domestic payment processing solutions, a versatile mobile authentication, and e-signature platform. Our digital government infrastructure includes over 600 software programs, hardware components, and devices. New techniques and monitoring of attacks During May's cyberbattle, white hat hacker teams can try out new attack techniques. For example, bypassing two-factor authentication (TOTP/2FA), sneaking past Content Security Policy (CSP), exploiting buffer overflows in user services, tricking DNS caching (DNS Cache Deception), and remotely running code through Python Pickle Deserialization. In total, the attackers will get the chance to trigger more than 120 critical events. Points will be awarded based on the complexity and success of the attacks. Blue teams (cybersecurity pros) will defend industries in investigation or response mode. In the first case, their mission is to log as many incidents as possible and investigate the attacks. In response mode, the teams will be able to prevent and counter attacks to protect their sectors. A global community of participants Teams from 15 countries, including France, Italy, Germany, Poland, Serbia, Russia, Kazakhstan, Uzbekistan, Armenia, Indonesia, Thailand, Vietnam, Tunisia, Oman, and the UAE, will clash at Standoff 15. Over 30 red teams (ethical hackers) will be on the offensive. Some of them joined us after rocking our April qualifier. Over 40 teams battled it out over five days for just five spots in the cyberbattle finals. Others snagged their invites thanks to their performance in previous Standoffs (13 and 14) and two seasons of the International Cybersecurity Games. Plus, 10 professional pentesting teams, including Southeast Asia's top talent, joined us through a special international program. There will be 13 blue teams participating in the event. Our judges, experts from both Standoff and ESC, will be keeping a close eye on the cyberbattle, making sure everyone plays fair and checking the reports from both the blue and red teams. The cyberbattle Standoff 15 is teaming up with top Russian tech companies. Digital Solutions, a leading Russian developer and manufacturer of network security hardware, provides the building blocks for a rock-solid IT and cybersecurity infrastructure for your entire digital kingdom. At the banking industry mockup, software solutions will be presented by eKassir, a developer of software for banks and financial institutions, and SafeTech, a developer of innovative solutions for securing remote banking systems and electronic document management. The NTI Center at MPEI, a developer of smart grid protection, automation, and digital twin solutions, will deploy its services on the energy sector model.
Over 500 speakers, reverse engineering in Cybercity, and a concert by Uma2rman: get ready for this year's Positive Hack Days!
The international cyberfestival Positive Hack Days hits Luzhniki Olympic Complex on May 22–24, backed by the Russian Ministry of Digital Development. The City of Moscow is our strategic partner. This year's festival is powered by the Social Development Complex, the Department of Information Technology, the Department of Entrepreneurship and Innovative Development, and the Moscow Department of Finance. This event will uncover the secrets of technology and how it shapes our everyday lives. The event will have two tracks: a closed-door conference for tech experts and business leaders, and a public session open to everyone. Our program features 270 talks, 26 tracks, and over 500 speakers. In the free, open-access zone, explore the revamped Cybercity, packed with interactive installations. Visitors will playfully discover the secrets of smart devices and learn how to use them securely. Reverse engineers (a special breed of hacker) will help them with this, sharing their knowledge and showing what's under the hood of these technologies. At our popular science hack fest, you'll dive into a world of digital innovation and meet the entrepreneurs and innovators who are building it. The Kulibin Stage, named after the legendary inventor, will bring together leading tech experts and representatives from government agencies, including Russian Ministry of Finance, Central Bank of Russia, Moscow Department of Transport, and Moscow Department of Information Technology. Our speaker lineup includes tech influencer Wylsacom, along with IT experts from T-Bank, Yandex Cloud, PREMIER, and more. Seasoned experts will spill the tea on cybercriminal scams, IT career paths, AI, and tech startups, while our youngest speakers from the Movement of the First will share their first forays into the tech world. There's also the Safety in Motion School zone where you can learn the right way—and more importantly, the safe way—to use personal mobility devices. Plus, there will be sports training sessions, fun quests for kids, and workshops for young professionals. We'll also have an internship alley featuring the country's top universities, like Moscow State University, Higher School of Economics, Bauman Moscow State Technical University, ITMO University, and more. On the evening of May 24, get ready for an open-air concert featuring Uma2rman, Ksenia Minaeva, and GRUNGE.
Tickets now on sale for Positive Hack Days 2
All the money collected will go to the Podari Zhizn charity foundation. Positive Hack Days cyberfestival will take place in Moscow's Luzhniki sports complex on May 23–26. Tickets are now on sale for the expert area where the business and technical programs will take place. Access to all other locations, including the Standoff cyberbattle, will be free for everyone. The festival will feature two main areas. In the public space, you'll find hands-on educational exhibits that are open for all to enjoy at no cost. These installations are designed to introduce you to the digital realm and improve your understanding of cybersecurity. For the first time, all guests will get to witness the Standoff cyberbattle—a face-off between ethical hackers and defenders battling for control over a virtual state. At the expert area, the best of the cybersecurity industry will gather, from beginners to renowned experts, as well as CIOs, and CISOs of major IT companies. Over 250 speakers will be hitting the stage to discuss the latest cybersecurity topics across both technical and business tracks. If you are wishing to visit the expert area, you'll need to buy an entry ticket. In 2024, there's a fresh new ticket sales scheme rolling out at the cyberfestival. Guests will have the freedom to choose their own price and instantly score two tickets to the festival. The minimum purchase amount is 1,000 rubles. All the proceeds from sales will go to the Podari Zhizn charity foundation. As always, speakers who are eager to showcase the results of their research at the cyberfestival will have free access to any area of the festival. Anyone can be a speaker: from beginners to established pros. Apply to speak by April 1ˢᵗ. This year, the cyberfestival is bringing back the PHDays Everywhere format. As part of Youth Day on May 25ᵗʰ, a teleconference will bring together venues in five cities across the country: Moscow, Saint Petersburg, Kazan, Nizhny Novgorod, and Tomsk. What's more, the cyberfestival is going global: we're excited to announce a new location in Bangkok, Thailand. Last year, the event was held open to the public: the large urban cyberfestival in Moscow's Gorky Park was attended by 55,000 visitors, with about 100,000 more following online.
Become a speaker at the Positive Hack Days cyberfestival
The festival will take place at Moscow's Luzhniki sports complex on May 23–26. The call for papers is already open. APT attacks are rising in number, AI is helping hackers to innovate and adapt their attack schemes, and nearly all companies are at risk of data breaches, including the loss of sensitive customer data. These and other vital cybersecurity issues will be discussed by the participants of the international cyberfestival Positive Hack Days 2 that will be held at the Luzhniki sports complex in Moscow on May 23–26. The festival will bring together the best experts, representatives of ministries and agencies, and senior managers of various companies, as well as users of digital products who regularly face cybersecurity issues. The call for papers is open until March 15. For four days the Luzhniki sports complex will turn into a real cyberarena. In the open area of the festival—a true metropolis accessible to all visitors—interactive installations will educate the public about the digital world, increasing cybersecurity awareness in a fun way. Students, developers, hackers, CIOs, CISOs, and CEOs of major IT companies will gather to discuss the most compelling cybersecurity issues of the day. Over 250 speakers will discuss noteworthy cyberattacks and ways to prevent them. Papers addressing topics such as defensive and offensive security, development, use of machine learning in information security, blockchain technology, and other pertinent cybersecurity topics are welcome. The Positive Hack Days festival is open to both seasoned professionals and novice researchers just embarking on this journey. Previous merits and achievements are important, but our focus is on a fresh look at trending information security issues and offbeat solutions. The technical track traditionally includes the following topics: Countering hackers and responding to incidents New attack techniques and vectors, exploitation of vulnerabilities Application development and security Machine learning technologies and their security Our technical program will also host a community track where open source cybersecurity projects will be discussed. This year we also welcome speakers for our business track to discuss fundamental cybersecurity issues, such as enterprise information security architecture, result-driven cybersecurity, what a CISO must know to effectively get a point across to senior managers, how the cybersecurity market operates, the inner workings of the dark web, how to build an efficient cyberthreat prevention center, and many other important issues. Our goal is to make cybersecurity transparent and understandable to all stakeholders. Participants can submit their applications until midday on March 15. In addition, the festival will once again host the Standoff cyberbattle between red and blue teams. Visitors will see the consequences of cyberattacks on the infrastructure of the digital state: some sectors may even suffer from non-tolerable events. In 2023, PHDays Fest was held open to the public for the first time: the large urban cyberfestival in Moscow's Gorky Park was attended by 55,000 visitors, with about 100,000 more following online. See you at the international cyberfestival Positive Hack Days 2 at Luzhniki!
PHDays 12: trusting the tech thanks to cybersecurity
Digital technology has made our lives brighter, more convenient, and more efficient. However, the rise of sophisticated cyberattacks is undermining people’s confidence in this brave new cyberworld. The Positive Hack Days 12 international festival on practical security, which will be held on May 19 and 20 in Moscow’s Gorky Park, will reinstall this confidence by opening its doors to people from outside the cybersecurity community for the first time. The new cyberfestival format will be of interest not only to cybersecurity specialists, government, and businesses, but also to ordinary people who will get to see how the digital world truly works and take a step towards trusting new technology. This year PHDays will no longer be a closed event, and the new venue was not chosen accidentally. Known for its festivals and events, Gorky Park is one of the most famous public spaces of the capital, visited by about 30 million people annually. For the two days in May, the park will be changed beyond recognition. The forum will be divided into two zones: the central part of the park will be turned into an open digital city where everyone will be able to learn the basics of cybersecurity, while on the Pushkin embankment, a cybervillage will be built where the usual forum program with reports, discussions, and competitions will take place. The open area of the forum will represent a modern metropolis hit by an onslaught of cyberattacks. Guests will take on the role of security researchers and join in a quest in which they will try to find and fix vulnerabilities in various infrastructure components of the digital city. For this, they will need to use a special ability—to see the city through the eyes of hackers. In the cybervillage, digital nomads will be spread out amongst the tents. The elite of the cybersecurity industry will also gather there, to discuss the most acute issues related to cybersecurity. This year, the forum will see more than 100 speakers, including developers, security experts, hackers, CIOs, and CISOs of large IT companies. The PHDays 12 technical agenda covers such issues as: Countering hackers** and responding to incidents New attack techniques and vectors, exploitation of vulnerabilities Application development* and security* ML technologies* and cybersecurity* The first speakers are already confirmed. They include Wildberries Information Security Director Anton Zhabolenko and Head of Infrastructure Security Pavel Parkhomets, who will share their experience in designing a privileged access management (PAM) system for a distributed Linux infrastructure; Oleg Skulkin, Head of Cyberthreat Intelligence at BI.ZONE, who will talk about how, why and by whom attacks are made on Linux-based infrastructure amidst import substitution; Alexander Korotin, Senior Application Security Specialist at Kaspersky, who will discuss the vulnerability of backup tools which can become an entry point for attackers striving to compromise the network; and Sergey Prilutsky, Chief Research Officer at MixBytes, who will break down common vulnerabilities of Ethereum smart contracts and explain how to protect your protocols from new attack vectors. Security researchers still have one last opportunity to apply for a speaker slot in the cybervillage: Call For Papers has been extended through April 7. The Standoff cyberrange is a model of a digital state with three dozen teams of attackers and defenders battling for control over its resources. This time, the cyberrange will be modernized and expanded. In addition to the energy, oil and steel sectors, the nuclear industry sector will be built. New facilities will appear in all sectors, such as a solar power plant and a dispatch control center in the power sector. The attackers will try to trigger more than 100 non-tolerable events. For two days, the PHDays 12’s live studio will cover the key events of the forum and the Standoff cyberbattle, and host discussions on the most burning cybersecurity issues with the most prominent speakers and guests. On the forum’s stage, information security specialists will explain the basics of cybersecurity to everyday people who don’t otherwise think much about it. Please note that those wishing to attend the closed part of the forum need to purchase a ticket. This can be done right now: up to midnight on April 7, the ticket to the cybervillage will cost only 14,700 rubles; from April 8, the price will be 21,300 rubles. The central part of the park with the digital city will be open and free to all visitors. See you on May 19 and 20 at PHDays in Gorky Park!
PHDays 12: trusting the tech thanks to cybersecurity
Digital technology has made our lives brighter, more convenient, and more efficient. However, the rise of sophisticated cyberattacks is undermining people's confidence in this brave new cyberworld. The Positive Hack Days 12 international festival on practical security, which will be held on May 19 and 20 in Moscow's Gorky Park, will reinstall this confidence by opening its doors to people from outside the cybersecurity community for the first time. The new cyberfestival format will be of interest not only to cybersecurity specialists, government, and businesses, but also to ordinary people who will get to see how the digital world truly works and take a step towards trusting new technology. This year PHDays will no longer be a closed event, and the new venue was not chosen accidentally. Known for its festivals and events, Gorky Park is one of the most famous public spaces of the capital, visited by about 30 million people annually. For the two days in May, the park will be changed beyond recognition. The forum will be divided into two zones: the central part of the park will be turned into an open digital city where everyone will be able to learn the basics of cybersecurity, while on the Pushkin embankment, a cybervillage will be built where the usual forum program with reports, discussions, and competitions will take place. The open area of the forum will represent a modern metropolis hit by an onslaught of cyberattacks. Guests will take on the role of security researchers and join in a quest in which they will try to find and fix vulnerabilities in various infrastructure components of the digital city. For this, they will need to use a special ability—to see the city through the eyes of hackers. In the cybervillage, digital nomads will be spread out amongst the tents. The elite of the cybersecurity industry will also gather there, to discuss the most acute issues related to cybersecurity. This year, the forum will see more than 100 speakers, including developers, security experts, hackers, CIOs, and CISOs of large IT companies. The PHDays 12 technical agenda covers such issues as: Countering hackers and responding to incidents New attack techniques and vectors, exploitation of vulnerabilities Application development and security ML technologies and cybersecurity The first speakers are already confirmed. They include Wildberries Information Security Director Anton Zhabolenko and Head of Infrastructure Security Pavel Parkhomets, who will share their experience in designing a privileged access management (PAM) system for a distributed Linux infrastructure; Oleg Skulkin, Head of Cyberthreat Intelligence at BI.ZONE, who will talk about how, why and by whom attacks are made on Linux-based infrastructure amidst import substitution; Alexander Korotin, Senior Application Security Specialist at Kaspersky, who will discuss the vulnerability of backup tools which can become an entry point for attackers striving to compromise the network; and Sergey Prilutsky, Chief Research Officer at MixBytes, who will break down common vulnerabilities of Ethereum smart contracts and explain how to protect your protocols from new attack vectors. Security researchers still have one last opportunity to apply for a speaker slot in the cybervillage: Call For Papers has been extended through April 7. The Standoff cyberrange is a model of a digital state with three dozen teams of attackers and defenders battling for control over its resources. This time, the cyberrange will be modernized and expanded. In addition to the energy, oil and steel sectors, the nuclear industry sector will be built. New facilities will appear in all sectors, such as a solar power plant and a dispatch control center in the power sector. The attackers will try to trigger more than 100 non-tolerable events. For two days, the PHDays 12's live studio will cover the key events of the forum and the Standoff cyberbattle, and host discussions on the most burning cybersecurity issues with the most prominent speakers and guests. On the forum's stage, information security specialists will explain the basics of cybersecurity to everyday people who don't otherwise think much about it. Please note that those wishing to attend the closed part of the forum need to purchase a ticket. This can be done right now: up to midnight on April 7, the ticket to the cybervillage will cost only 14,700 rubles; from April 8, the price will be 21,300 rubles. The central part of the park with the digital city will be open and free to all visitors. See you on May 19 and 20 at PHDays in Gorky Park!
Positive Hack Days 12 will be held in Gorky Park on May 19–20
Call for speakers is now open. Following last year's cyberattacks, even previously laid-back people are now concerned about cybersecurity. That's why we decided to make the twelfth Positive Hack Days information security forum even more open and large-scale: it will be held at Gorky Park in Moscow on May 19 and 20, 2023. We've already started preparing for the event and are accepting applications from speakers. You can submit a talk topic until March 25. In 2022, PHDays set another attendance record: 10,000 visitors came in person and over 130,000 viewers watched online. In 2023, the forum's audience will expand even further thanks to the city festival format and the open-air venue in one of the capital’s most popular parks. If you still think that cybercriminals can't be interested in you or your company, this is a delusion with potentially disastrous consequences. Information security concerns absolutely everyone and should be common public knowledge. That's why this year's forum will have a more open format, with a range of activities for everyone to get involved in. At the same time, all the traditional events and tracks, including cybersecurity competitions, will remain. PHDays will once again host the Standoff cyberbattle in which attackers and defenders will test the infrastructural security of a digital state and uncover possible chains of non-tolerable events in various industries. If you want to share your own valuable discoveries and developments, talk about bug bounty, participating in Standoff, or what it's like to be a red or blue team expert, become a speaker! The forum is open to all researchers: the program committee will consider applications from both established infosec experts and newcomers. More than anything, we'd love to hear original perspectives on current problems in information security. At PHDays 12, we're looking forward to hearing expert talks on both defensive and offensive security. We are also looking for speakers on the topics of development, blockchain, and machine learning in information security. But if you have an interesting cybersecurity talk or presentation on a different theme, we'll be happy to consider it. If you have something to say about data leaks, turnover penalties, mergers and acquisitions in the Russian cybersecurity market, or the prospect of AI replacing infosec experts, you are welcome at the business session of the forum. The event evolves, but the conditions of participation remain the same. All presentations at PHDays 12 will be in the form of a talk (50 minutes) or a fast track (15 minutes). How to apply To take part in the forum, fill out an application on the CFP page with information about yourself and your proposed talk. If your research has already been published, specify the relevant conference, journal, or website. If you know of similar work by other researchers, give details and indicate how your approach is different. You may submit as many proposals as you want. Speakers delivering 50-minute talks who are not in Moscow will be provided with a transfer to and from the PHDays venue, hotel accommodation, and two additional tickets to the forum. Don't hesitate to apply, and mark May 19 and 20 on your calendars! See you at PHDays!
Russian social network VK joins The Standoff 365 Bug Bounty
VK has launched a bug bounty program on The Standoff 365 Bug Bounty, a platform developed by Positive Technologies for uncovering vulnerabilities. A bug bounty program offers rewards to outside researchers for discovering and reporting security flaws before attackers can find and exploit them. The VK bug bounty consists of over 40 projects. Rewards range from $100 to $30,000, depending on the severity level of reported vulnerabilities. VK was one of the first companies in Russia to offer rewards to external researchers for reporting vulnerabilities. Since 2013, the company has received over 15,000 bug bounty reports and used them to fix vulnerabilities and strengthen the protection of users' personal data. In total, the company has paid out more than $3 million in bug bounties.
PHDays 11 wrap-up: interest in information security explodes, Rutube attack investigated, pipeline shutdown demo
Information security is directly linked to the security of the general public and the entire state. This was underscored repeatedly at the international practical security forum Positive Hack Days 11. A live demonstration took place as part of the world’s biggest open cyberbattle, The Standoff. The events were the most watched in their history: over 127,000 online viewers and participants and 8,700 visitors on-site in Moscow. The PHDays 11 program included around 100 talks, discussion sections, and round tables, contests with cash prizes (for example, hacking an ATM, a POS terminal, or a cash register), the creative festivals Positive Wave and HackerToon, the final of the first All-Russian open-source project competition for schoolchildren and students, a cyberart theft competition, and much more besides.
PHDays 11 talks: bootkit infection, sanitizers for the Linux kernel, the new face of OSINT, and phishing on official websites
Positive Hack Days 11 will begin in a matter of weeks. This international forum on practical security will be held on May 18–19 in Moscow. The red and blue teams for The Standoff have already been formed, and we are putting the finishing touches to the cyberrange infrastructure and the conference program. As per tradition, PHDays will have three big tracks dedicated to countering attacks (defensive), protection through attack (offensive), and the impact of cybersecurity on business. It is our pleasure to present the first talks. How to detect 95% of attacks covering 5% of threat actors' techniques Oleg Skulkin, Head of Digital Forensics and Incident Response Team, Group-IB, will analyze a short list of techniques (used by almost all threat actors, no matter their sophistication) based on real-world attack scenarios. This provides detection opportunities even if there is very little data. IoC scoring When dealing with indicators of compromise, analysts need to quickly understand the danger posed by the object in question. For this purpose, a special threat intelligence score is used. How exactly the vendor calculates it is often a commercial secret. Nikolay Arefiev, co-founder of RST Cloud, will explain how scoring works using the example of open indicators. If you have bootkits When a computer is infected with viruses at the user level, you can use known methods of counteraction that rely on the kernel API. And what if the OS kernel itself or the firmware is compromised? Anton Belousov, Senior Specialist at Malware Detection, Positive Technologies, will talk about potential vectors of infecting BIOS- and UEFI-based systems with bootkits, and explain how to use the Xen–LibVMI–Drakvuf bundle to monitor malware behavior and what events or signs are indicative of an attempt to introduce a bootkit. Sanitizing the Linux kernel In his report, independent information security researcher Andrey Konovalov will focus on KASAN implementation and practical usage, but will also briefly cover other sanitizers—the main tools for detecting bugs in the Linux kernel. KASAN detects memory safety issues: out-of-bounds and use-after-free bugs in slab, page_alloc, vmalloc, stack, and global memory. Open-source intelligence Andrey Masalovich, CEO, Inforus, will cover 20 practical OSINT techniques leveraging the opportunities of the digital age: image search using neural networks, collecting information from the dark web, detecting cloud storage leaks, tracking a user's digital footprint. Qualcomm BootROM Vulnerabilities in BootROM, the most important component of hardware and software security, can lead to attackers gaining full control over the device. Independent researcher Dmitry Artamonov will discuss the role of BootROM in the Android smartphone boot chain. He will also talk about BootROM vulnerabilities of various mobile device vendors, share his experience of getting access to the JTAG interface in a Qualcomm smartphone, explain how to use it to extract the BootROM image from a modern device, and demonstrate successful exploitation of a one-day vulnerability in BootROM. Phishing on official websites It is generally believed that fake websites are used for phishing. And if the site is genuine? What specific issues can lead to such consequences as website hacking? Independent information security researcher Aleksandr Kolchanov will give a number of examples of not just small companies easily falling victim to such phishing attacks, but large banks and airlines too. He will talk about common and lesser-known problems, including subdomain takeover and attacks on administrators of external services and on URL shorteners. The co-organizer of PHDays 11 and The Standoff cyberbattle is the Innostage Group. The business partners of the forum are Security Vision, a developer of cybersecurity solutions, Rostelecom-Solar, a national provider of information security services and technologies, and MONT, a distributor of software for any business. The technological partner is Azbuka Vkusa. The partners of PHDays 11 are Axoft, Fortis, ICL System Technologies, InfoWatch, Marvel Distribution, R-Vision, Gazinformservice, Pangeo Radar, Jet Infosystems, Liberum Veritas, IBS Platformix, and USSC. Stay tuned for more updates!