**Digital technology has made our lives brighter, more convenient, and more efficient. However, the rise of sophisticated cyberattacks is undermining people’s confidence in this brave new cyberworld. The Positive Hack Days 12 international festival on practical security, which will be held on May 19 and 20 in Moscow’s Gorky Park, will reinstall this confidence by opening its doors to people from outside the cybersecurity community for the first time. The new cyberfestival format will be of interest not only to cybersecurity specialists, government, and businesses, but also to ordinary people who will get to see how the digital world truly works and take a step towards trusting new technology.** 

 This year PHDays will no longer be a closed event, and the new venue was not chosen accidentally. Known for its festivals and events, Gorky Park is one of the most famous public spaces of the capital, visited by about 30 million people annually. For the two days in May, the park will be changed beyond recognition. The forum will be divided into two zones: the central part of the park will be turned into an open digital city where everyone will be able to learn the basics of cybersecurity, while on the Pushkin embankment, a cybervillage will be built where the usual forum program with reports, discussions, and competitions will take place.

 The open area of the forum will represent a modern metropolis hit by an onslaught of cyberattacks. Guests will take on the role of security researchers and join in a quest in which they will try to find and fix vulnerabilities in various infrastructure components of the digital city. For this, they will need to use a special ability—to see the city through the eyes of hackers.

 In the cybervillage, digital nomads will be spread out amongst the tents. The elite of the cybersecurity industry will also gather there, to discuss the most acute issues related to cybersecurity. This year, the forum will see more than 100 speakers, including developers, security experts, hackers, CIOs, and CISOs of large IT companies.

 The PHDays 12 technical agenda covers such issues as:

* **Countering hackers** and responding to incidents
* New **attack techniques** and **vectors**, exploitation of vulnerabilities
* **Application development** and **security**
* **ML technologies** and **cybersecurity**

 The first speakers are already confirmed. They include Wildberries Information Security Director Anton Zhabolenko and Head of Infrastructure Security Pavel Parkhomets, who will share their experience in designing a privileged access management (PAM) system for a distributed Linux infrastructure; Oleg Skulkin, Head of Cyberthreat Intelligence at BI.ZONE, who will talk about how, why and by whom attacks are made on Linux-based infrastructure amidst import substitution; Alexander Korotin, Senior Application Security Specialist at Kaspersky, who will discuss the vulnerability of backup tools which can become an entry point for attackers striving to compromise the network; and Sergey Prilutsky, Chief Research Officer at MixBytes, who will break down common vulnerabilities of Ethereum smart contracts and explain how to protect your protocols from new attack vectors.

 Security researchers still have one last opportunity to apply for a speaker slot in the cybervillage: [Call For Papers](https://www.phdays.com/en/join/?utm%5Fsource=phd&utm%5Fmedium=cpm&utm%5Fcampaign=phd11&utm%5Fcontent=main-banner) has been extended through April 7.

 The Standoff cyberrange is a model of a digital state with three dozen teams of attackers and defenders battling for control over its resources. This time, the cyberrange will be modernized and expanded. In addition to the energy, oil and steel sectors, the nuclear industry sector will be built. New facilities will appear in all sectors, such as a solar power plant and a dispatch control center in the power sector. The attackers will try to trigger more than 100 non-tolerable events.

 For two days, the PHDays 12’s live studio will cover the key events of the forum and the Standoff cyberbattle, and host discussions on the most burning cybersecurity issues with the most prominent speakers and guests.

 On the forum’s stage, information security specialists will explain the basics of cybersecurity to everyday people who don’t otherwise think much about it.

 Please note that those wishing to attend the closed part of the forum need to [purchase a ticket](https://phdays23.ruwidgets.ru/en/). This can be done right now: up to midnight on April 7, the ticket to the cybervillage will cost only 14,700 rubles; from April 8, the price will be 21,300 rubles. The central part of the park with the digital city will be open and free to all visitors.

**See you on May 19 and 20 at PHDays in Gorky Park!** 

  

PHDays 12: trusting the tech thanks to cybersecurity

**Digital technology has made our lives brighter, more convenient, and more efficient. However, the rise of sophisticated cyberattacks is undermining people's confidence in this brave new cyberworld. The Positive Hack Days 12 international festival on practical security, which will be held on May 19 and 20 in Moscow's Gorky Park, will reinstall this confidence by opening its doors to people from outside the cybersecurity community for the first time. The new cyberfestival format will be of interest not only to cybersecurity specialists, government, and businesses, but also to ordinary people who will get to see how the digital world truly works and take a step towards trusting new technology.**

This year [PHDays](https://phdays.com/en/) will no longer be a closed event, and the new venue was not chosen accidentally. Known for its festivals and events, Gorky Park is one of the most famous public spaces of the capital, visited by about 30 million people annually. For the two days in May, the park will be changed beyond recognition. The forum will be divided into two zones: the central part of the park will be turned into an open digital city where everyone will be able to learn the basics of cybersecurity, while on the Pushkin embankment, a cybervillage will be built where the usual forum program with reports, discussions, and competitions will take place.

The open area of the forum will represent a modern metropolis hit by an onslaught of cyberattacks. Guests will take on the role of security researchers and join in a quest in which they will try to find and fix vulnerabilities in various infrastructure components of the digital city. For this, they will need to use a special ability—to see the city through the eyes of hackers.

In the cybervillage, digital nomads will be spread out amongst the tents. The elite of the cybersecurity industry will also gather there, to discuss the most acute issues related to cybersecurity. This year, the forum will see more than 100 speakers, including developers, security experts, hackers, CIOs, and CISOs of large IT companies.

The PHDays 12 technical agenda covers such issues as:

- Countering hackers and responding to incidents
- New attack techniques and vectors, exploitation of vulnerabilities
- Application development and security
- ML technologies and cybersecurity

The first speakers are already confirmed. They include Wildberries Information Security Director Anton Zhabolenko and Head of Infrastructure Security Pavel Parkhomets, who will share their experience in designing a privileged access management (PAM) system for a distributed Linux infrastructure; Oleg Skulkin, Head of Cyberthreat Intelligence at BI.ZONE, who will talk about how, why and by whom attacks are made on Linux-based infrastructure amidst import substitution; Alexander Korotin, Senior Application Security Specialist at Kaspersky, who will discuss the vulnerability of backup tools which can become an entry point for attackers striving to compromise the network; and Sergey Prilutsky, Chief Research Officer at MixBytes, who will break down common vulnerabilities of Ethereum smart contracts and explain how to protect your protocols from new attack vectors.

Security researchers still have one last opportunity to apply for a speaker slot in the cybervillage: [Call For Papers has been extended through April 7.](https://cfp.phdays.com/login?utm_source=phd&utm_medium=cpm&utm_campaign=phd11&utm_content=main-banner)

The Standoff cyberrange is a model of a digital state with three dozen teams of attackers and defenders battling for control over its resources. This time, the cyberrange will be modernized and expanded. In addition to the energy, oil and steel sectors, the nuclear industry sector will be built. New facilities will appear in all sectors, such as a solar power plant and a dispatch control center in the power sector. The attackers will try to trigger more than 100 non-tolerable events.

For two days, the PHDays 12's live studio will cover the key events of the forum and the Standoff cyberbattle, and host discussions on the most burning cybersecurity issues with the most prominent speakers and guests.

On the forum's stage, information security specialists will explain the basics of cybersecurity to everyday people who don't otherwise think much about it.

Please note that those wishing to attend the closed part of the forum need to [purchase a ticket.](https://phdays23.ruwidgets.ru/en/) This can be done right now: up to midnight on April 7, the ticket to the cybervillage will cost only 14,700 rubles; from April 8, the price will be 21,300 rubles. The central part of the park with the digital city will be open and free to all visitors.

See you on May 19 and 20 at PHDays in Gorky Park!

## [Call for speakers is now open.](https://cfp.phdays.com/login)

Following last year's cyberattacks, even previously laid-back people are now concerned about cybersecurity. That's why we decided to make the twelfth Positive Hack Days information security forum even more open and large-scale: it will be held at Gorky Park in Moscow on May 19 and 20, 2023. We've already started preparing for the event and are accepting applications from speakers. You can submit a talk topic until March 25.

In 2022, PHDays set another attendance record: 10,000 visitors came in person and over 130,000 viewers watched online. In 2023, the forum's audience will expand even further thanks to the city festival format and the open-air venue in one of the capital’s most popular parks.

If you still think that cybercriminals can't be interested in you or your company, this is a delusion with potentially disastrous consequences. Information security concerns absolutely everyone and should be common public knowledge. That's why this year's forum will have a more open format, with a range of activities for everyone to get involved in. At the same time, all the traditional events and tracks, including cybersecurity competitions, will remain.

PHDays will once again host the Standoff cyberbattle in which attackers and defenders will test the infrastructural security of a digital state and uncover possible chains of non-tolerable events in various industries. If you want to share your own valuable discoveries and developments, talk about bug bounty, participating in Standoff, or what it's like to be a red or blue team expert, become a speaker!

The forum is open to all researchers: the program committee will consider applications from both established infosec experts and newcomers. More than anything, we'd love to hear original perspectives on current problems in information security.

At PHDays 12, we're looking forward to hearing expert talks on both defensive and offensive security. We are also looking for speakers on the topics of development, blockchain, and machine learning in information security. But if you have an interesting cybersecurity talk or presentation on a different theme, we'll be happy to consider it.

If you have something to say about data leaks, turnover penalties, mergers and acquisitions in the Russian cybersecurity market, or the prospect of AI replacing infosec experts, you are welcome at the business session of the forum.

The event evolves, but the conditions of participation remain the same. All presentations at PHDays 12 will be in the form of a talk (50 minutes) or a fast track (15 minutes).

## How to apply

To take part in the forum, fill out an application on the CFP page with information about yourself and your proposed talk.

If your research has already been published, specify the relevant conference, journal, or website. If you know of similar work by other researchers, give details and indicate how your approach is different.

You may submit as many proposals as you want.

Speakers delivering 50-minute talks who are not in Moscow will be provided with a transfer to and from the PHDays venue, hotel accommodation, and two additional tickets to the forum.

Don't hesitate to apply, and mark May 19 and 20 on your calendars!

See you at PHDays!

Positive Hack Days 12 will be held in Gorky Park on May 19–20

VK has launched a bug bounty program on The Standoff 365 Bug Bounty, a platform developed by Positive Technologies for uncovering vulnerabilities. A bug bounty program offers rewards to outside researchers for discovering and reporting security flaws before attackers can find and exploit them.

The VK bug bounty consists of over 40 projects. Rewards range from $100 to $30,000, depending on the severity level of reported vulnerabilities.

VK was one of the first companies in Russia to offer rewards to external researchers for reporting vulnerabilities. Since 2013, the company has received over 15,000 bug bounty reports and used them to fix vulnerabilities and strengthen the protection of users' personal data. In total, the company has paid out more than $3 million in bug bounties.

The security of our customers and their trust in VK services have always been a priority for us. We use various tools to strengthen our cybersecurity defenses, and we have long taken advantage of bug bounty programs to test the quality of our services. This method has a real practical benefit. In the last six months, the number of cyberattacks in Russia has increased manifold, and we are happy to see Russian companies launching their own bug bounty platforms. By introducing our bug bounty program on The Standoff 365, we will boost VK's ability to identify vulnerabilities and fix them as quickly as possible.

It takes courage for a company to bring in outside cybersecurity experts. But that's exactly the right way for companies to get a reliable and objective assessment of their security, so they can eliminate vulnerabilities in their IT infrastructure before the bad guys find them and cause irreparable damage. Launching a bug bounty program means thinking in the long term. It's a sign that a company is open and cares about the security of its customers' personal data. The mere fact that you have a bounty program makes people trust you more. We are happy to welcome VK on our platform, and we look forward to continued cybersecurity cooperation with such an experienced bug bounty organizer.

Positive Technologies announced the launch of [The Standoff 365 Bug Bounty platform ](https://bugbounty.standoff365.com/en-US)at PHDays 11 in May this year. Security researchers working on the platform will be rewarded for identifying vulnerabilities and also for demonstrating ways in which they can be exploited. 1600 researchers have already registered for The Standoff 365 Bug Bounty and submitted 49 vulnerability reports, with the first report being sent 60 just minutes after the platform was launched. Positive Technologies and Russian supermarket chain Azbuka Vkusa were the first companies to host their bug bounty programs on the platform.

The creators of The Standoff 365 Bug Bounty expect that 10 to 20 organizations will add their bug bounties to the platform in 2022. By 2025, that number may exceed 100.

Russian social network VK joins The Standoff 365 Bug Bounty

**Information security is directly linked to the security of the general public and the entire state. This was underscored repeatedly at the international practical security forum [Positive Hack Days 11](https://www.phdays.com/en/). A live demonstration took place as part of the world’s biggest open cyberbattle, [The Standoff](https://standoff365.com/en-US). The events were the most watched in their history: over 127,000 online viewers and participants and 8,700 visitors on-site in Moscow.**

The PHDays 11 program included around 100 talks, discussion sections, and round tables, contests with cash prizes (for example, hacking an ATM, a POS terminal, or a cash register), the creative festivals Positive Wave and HackerToon, the final of the first All-Russian open-source project competition for schoolchildren and students, a cyberart theft competition, and much more besides.

Here are some of the incidents instigated by attackers during the four days of The Standoff: oil production stoppage (in the infrastructure of the oil and gas company Tube, which is engaged in oil and gas production, refining, storage, and sale), oil-product pipeline shutdown, disruption of wastewater treatment facilities. The triggering of such threats in real life could have the gravest consequences. The attacks on the Ferris wheel, the jet bridge, and many other facilities of the virtual State F were brought to their logical conclusion.

The hackers actuated a total of 63 unacceptable events, 30 of which were unique. For comparison: in the November cyberbattle, only six unique unacceptable events were triggered. Almost all companies suffered, with the exception of the banking system. Of the 17 red teams, 14 managed to disrupt the railway ticketing system. In addition, malware was introduced into the development process. 

The winners of the cyberexercise on the attacking side were the Codeby team (27,715 points), with True0xA3 in second place (23,381 points), and Invuls in third (12,352 points). During the four-day event, the attackers submitted 295 vulnerability reports. About 40 percent of these reports were sent by Codeby, DeteAct, and Bulba Hackers. Most vulnerabilities were detected at the Heavy Logistics shipping company.

Over the four days, the defenders submitted 287 incident reports and 10 investigation reports. The ZoneZone team turned in the most reports. The minimum investigation time was one hour and 13 minutes; the average was nine hours and 15 minutes.

_"Participation in The Standoff is always beneficial for us,"_ said **Nikolay Nashivochnikov, Deputy CEO and Technical Director, Gazinformservice, on behalf of the defenders.** _"Members of GiSCyberTeam uncover and investigate incidents in conditions that are even more severe than real ones, with more restricted protection functionality. Today, large-scale cyberattacks on critical information infrastructure are almost non-stop. In the current context, these cyberexercises are a great opportunity to apply one’s skills and develop attack prevention strategies. Enterprises and business structures in Russia are facing ever more cyberthreats, so, as information security professionals, we treat this event like work. Monitoring and investigating information security events is fascinating and exciting, but it’s still a job."_

### How Rutube was attacked

Towards the evening of day two of PHDays 11, guests of the forum’s on-air studio shared details of the May attack on the video hosting service Rutube. Alexander Moiseev, Deputy CEO of Gazprom-Media Holding, stated that the service infrastructure had suffered considerable damage, but user data had been left untouched, which clearly indicates that the cybercriminals’ aim was to completely destroy the video platform. Alexey Novikov, Director of the Positive Technologies Expert Security Center (PT ESC), whose team is investigating the incident, noted that the attackers used publicly available tools, including Cobalt Strike, which is used by many pentesters, as well as traditional system administrator tools. Alexander Moiseev added that Gazprom-Media Holding plans to hold a session at the upcoming St. Petersburg International Economic Forum, where he will talk in detail about the incident in terms of its impact on users.

_"PT ESC analyzes the technical traces left by cybercriminals in the infrastructure, and thus reconstructs the entire chain of events,"_ said **Alexey Novikov.** _"The answer to the question of how this attack was carried out is crucial. It will ensure that such attacks never occur again."_

### How investigators look for information

Any action on a computer leaves a digital trace: opening, reading, modifying, deleting files; accessing a network; opening ports, and so on. This was brought up by Daniil Borislavsky, Head of Implementation at Atom Security, who presented the report "Investigating infosec incidents caused by employees: where to look, what to grab, how to catch" in the business track.

_"Such information stays on the computer, but there’s an awful lot of it,"_ he explained. _"You need search tools. The first of these is attribute search, which is fast, but only searches the outer properties of the files. The second is content search, that is, looking inside files. But this method is time-consuming and not every file can be opened."_

_"Today, when searching for information in images on a PC, incident investigators use OCR technology to translate data into text form. What’s more, it is not rational to analyze everything and anything, so dictionaries and regular expressions are needed. Another approach is to use neural networks. With their help, we were able, for example, to sort through and find scans of passports online,"_ noted Daniil Borislavsky.

### Banks set up crisis response groups 

On-air studio guests also discussed the importance of cybersecurity for finance industry executives.

Roman Chaplygin, Director of Business Consulting at Positive Technologies, spoke about the emergence of full-fledged cybersecurity crisis response teams at companies, which can include not only leaders, but ordinary employees with various skillsets.

_"If previously cybersecurity was at the bottom of the list of priorities, now top management is tackling the problem head-on: crisis committees are being set up, and companies are identifying potential targets and attack consequences,"_ he stated.

Independent expert Pavel Klimovich pointed out that bank executives are now focused on real threats. Prior to 2022, the list of such threats numbered up to a hundred. Now many companies are in the process of reassessing the actual risks, those that are really critical.

### AI to lend a hand 

The potential of artificial intelligence was discussed in the on-air studio by Igor Pestretsov, Advanced Technologies Specialist at Positive Technologies, and Mikhail Trofimov, DataGym lecturer and a Kaggle Grandmaster. The experts spoke about the application of artificial intelligence in various areas of life, including information security, about future growth in the use of neural networks, and about the transformation of many jobs and professions.

_"Artificial intelligence will very soon ease the cognitive load on infosec experts, allowing them to focus on really important issues, not on routine,"_ Igor Pestretsov believes.

_"We will see the development of general-purpose AI models, each of which can be trained once and its knowledge used in various tasks. There will be many different applications in the most unexpected areas, where such models will show good results right away. Therefore, I expect not so much qualitative as quantitative growth in the use of artificial intelligence,"_ reckons Mikhail Trofimov.

### How to build a SOC by effectively combining SOAR and SIEM

The number of infosec incidents has climbed significantly since February, increasing the load on SOCs. The leading presale manager of Security Vision Angelica Svoykina spoke about the use of SOAR systems to close infosec incidents.

_"SIEM often produces tens of millions of incidents per day. Compared to Q1 2021, the number of incidents has more than quadrupled. Despite this, the share of smart and sophisticated attacks has fallen: many ordinary users connect to botnets or follow instructions in attackers’ Telegram channels. And if previously attack duration was measured in minutes, since February the average duration has increased to several hours, and many attacks last for several days. All this is creating a huge workload for SOC analysts,"_ she remarked.

In her opinion, this load can be reduced through the interaction of SIEM and SOAR platforms, with the use of ticketing, incident management automation, connectors, and other measures.

### Thieves disguised as hacktivists

In recent months, Russia has seen a rise not only in hacktivism, but in financial attacks on Russian companies, which are currently seen by the world hacking community as fair game. This was reported by Oleg Skulkin, Head of Digital Forensics and Incident Response Team, Group-IB.

### After 01111111day, information security landscape started to change quickly and locally

In his talk, Kaspersky’s Chief Security Expert Sergey Golovanov presented data from late winter 2022 obtained using Kaspersky’s statistics system, examined cyberincidents, and talked about the tactics and methods used by the perpetrators.

There have been significant changes in information security since February 23, 2022\. The field was changing gradually and globally during the COVID-19 pandemic, but this year everything changes very quickly and locally, Sergey noted.

_"You can see 01111111day in Kaspersky Security Networks statistics. There wasn’t a single scam phone call made in Russia on February 24\. The scam calls eventually came back, but they still haven’t reached the volume we saw in early February. Why is that? For example, on April 15 there was a news story on TV about a den of scammers in Berdyansk, who were tricking Russian people. You can probably guess who was behind it,"_ said **Sergey Golovanov.** _"According to data from our dark web search engine, the number of dark web ads referring to Russian banks decreased sharply that day, then immediately shot back up again, but now they’re gone back down to zero."_

### On-premise SOC: how to build it without pain

Not all clients are willing to outsource their SOC, so they try to build one locally. Aside from geopolitical necessity, many companies have been categorizing, planning, and deploying information security systems over the last few months and getting ready to start monitoring their own infrastructure and interacting with NCIRCC. The third catalyst is connected to the President’s executive order from May 1 entitled "On additional measures for ensuring information security in the Russian Federation." _"When a company builds a SOC, the first thing it usually does is hire a consultant who can avoid repeated mistakes and unnecessary expenses. But if this person leaves, the company can find itself up a creek without a paddle and start running into problems as they develop their SOC. If they try to do it quickly and cheaply, that has its own risks. Everything might look fine on paper—the components are there, there’s content in the SIEM—but the very first penetration test will reveal that the SOC can’t actually see anything,"_ noted Andrey Proshin, Department Head of Solar JSOC, Rostelecom-Solar.

### Modern data center: what is it like?

Airat Mustafin, CEO of the IT outsourcing company Liberum Navitas, talked about data centers of tomorrow, pointing out that they have reached a new level of development and will follow banks and websites in becoming ecosystems, interacting with communities and individuals in a number of different ways. _"The things we use right now were created a long time ago. That goes for data centers—a lot of them are located in former warehouses, communication centers, and other facilities that weren’t intended for that purpose. Even nowadays, data centers are still built out of sandwich panels. Moreover, most data centers in Russia are in the western part of the country. There aren’t any east of the Urals. Modern data centers need, at minimum, a high level of automation—for example, servers can be moved between racks by robots,"_ said Airat Mustafin.

### Building an incident management process under the MSSP model

Roman Ovchinnikov, Head of Execution Department at Security Vision, discussed the principles of incident management in the MSSP model, focusing on issues related to building client interaction, methods for providing services, problems inherent in geographically distributed infrastructures, and the finer points of reporting. _"There have been two major growth phases in the MSSP market recently. The first one was connected to the pandemic and the large-scale transition to remote work, and the second was connected to what happened in February,"_ said Roman.

### Hunting for modern attacks on Active Directory infrastructure

During the technical presentation track, Teymur Kheirkhabarov and Demyan Sokolin from BI.ZONE admitted that they had been planning to talk about all known public attacks on Active Directory infrastructure and accompanying services from 2021 and 2022, but while they were getting ready for the presentation, they realized that an hour just wasn’t enough time to discuss it. So they decided to focus on attacks on Active Directory Certificate Services and discuss the most interesting and effective techniques used by intruders from the perspective of blue teams and SOCs. They also talked about how to detect these techniques via standard Windows logs and which correlation rules can be created in the SIEM system.

Active Directory infrastructure and related services are now an inextricable part of almost every corporate network. As a key infrastructure element, Active Directory is a tempting target for intruders. Maximum privileges obtained within the domain open doors to the infrastructure for attackers—or, if those "doors" aren’t integrated into Active Directory, it still becomes easier to open them.

_"From the perspective of Microsoft CA services settings, it’s just hell,"_ **Teymur** acknowledged. _"Needless to say, that’s if they’re properly configured and not just ’Next, Next, Done, go to production’. It’s a complex, comprehensive system with lots of parameters that, if improperly configured, can lead to the domain being fully compromised."_

### More about secure development

Alexey Zhukov (Head of DevSecOps Development, Positive Technologies), Alexey Babenko (Deputy Manager of Engineering, National Payment Card System), and Vladimir Kochetkov (Head of R&D for Code Analyzers, Positive Technologies) talked about what secure development means in information security and why it’s important. 

Participants shared their visions for secure development in information security and how to get developers to write bug-free code.

_"An application’s security should start with the architecture-planning phase and end with deployment. This means that the product should be secure at every stage of development,"_ said Vladimir Kochetkov.

Alexey Zhukov discussed the importance of dialog with developers and the need to motivate them in various ways to write secure code.

_"You need to get people invested in writing bug-free code. Developers can have all sorts of different motivations, from getting a raise to increasing their value on the labor market. Non-financial motivators are important too,"_ said Alexey.

Alexey Babenko noted that developers’ well-known skepticism of security professionals will pass once security becomes part of the development process.

### Bug bounty through the eyes of developers, users, and hackers

Round table participants discussed the development of Russian bug bounty platforms (including [The Standoff 365 Bug Bounty](https://bugbounty.standoff365.com/en-US)). Their discussion touched on launch issues, setting rewards for hackers, budgets for searching for and eliminating vulnerabilities, and the market’s future potential. We should mention here that 250 white hat hackers signed up on the platform during the first two days of its operation. Russian private grocery chain Azbuka Vkusa and Positive Technologies were the first companies to put their programs on the platform.

Yaroslav Babin, Director of The Standoff 365, Positive Technologies, talked about rethinking the approach to bug bounties on the new platform. _"Clients don’t always understand the impact, and hackers can sometimes achieve more than you would expect. We offered to pay hackers not just for finding vulnerabilities, but also for combining vulnerabilities into chains and sequences."_

Evgeny Voloshin, Head of Expert Services, BI.ZONE, believes that bug bounties have become mainstream in Russia. _"We’ve got three platforms launching almost simultaneously. This speaks to a market demand and a real need. Large platforms have their own issues, their own histories, but we aren’t bogged down by any kind of legacy. We have an opportunity to make everything awesome right out of the gate,"_ he said.

Russian Ministry of Digital Development, Communications, and Mass Media Cybersecurity Director Vladimir Bengin is confident that, with some help from experts, the issues associated with the development of bug bounty platforms in Russia can be overcome. _"At the Ministry, we’ve been hearing people talking about how bug bounties can be treated as a kind of gray area. We expect experts and people who have experience in this field to tell us how they would solve this problem. If we need to pass a law or take some other steps, we’re open to that."_

The topic of bug bounties and the appearance of the new platform, [The Standoff 365 Bug Bounty](https://bugbounty.standoff365.com/en-US), was also discussed by Vladimir Zapolyansky and his guests in the PHDays 11 on-air studio.

_"We bring business and hackers together,"_ said Yaroslav Babin, The Standoff 365 Product Director. _"Our goal is to get people from both camps involved. We’ve always had a good relationship with the hacking community. We’ve got the PHDays forum and The Standoff cyberexercises. We haven’t even launched yet, and 366 hackers have already registered on the platform. We won’t have any problems with research, and our community will continue to grow."_

Dmitry Kuzevanov, Technical Director of Azbuka Vkusa, believes that, prior to the launch of the Positive Technologies platform, there was simply no decent platform on the Russian market because it needed to be trusted by both companies and hackers. _"There’s a new platform now, and we’re eager to join it. We’re impressed by its reputation, confidence, and hacker traffic. We can trust Positive Technologies in this matter,"_ he said.

This ends our coverage of Positive Hack Days 11 and The Standoff. Follow our social media pages to keep up with all the latest news.

We remind you that Positive Technologies is the permanent organizer of PHDays and The Standoff. For the third time running, the Innostage group of companies was the co-organizer. Innostage experts deploy and maintain the cyberrange infrastructure. Specialists from the CyberART cyberthreat prevention center monitor the battle, supervise team actions, act as mentors for one of the defense teams, and demonstrate implemented attack chains to the forum guests.

The business partners of the forum are [Security Vision](https://www.securityvision.ru/en/), a developer of cybersecurity solutions, [Rostelecom-Solar](https://en.rt-solar.ru/), a national provider of information security services and technologies, and [MONT](https://www.mont.com/ru-ru), a distributor of software for any business. The technological partner is [Azbuka Vkusa](https://av.ru/). The partners of PHDays 11 are [Axoft](https://axoft.ru/), [Fortis](https://fortis.ru/), [Gazinformservice](https://www.gaz-is.ru/), [IBS Platformix](https://platformix.ru/), [ICL System Technologies](https://icl.ru/eng/), [InfoWatch](https://infowatch.com/), [Jet Infosystems](https://jetinfosystems.com/?from=ru), [Liberum Veritas](http://www.liberumnavitas.com/), [Marvel Distribution](https://www.marvel.ru/en/), [Pangeo Radar](https://pangeoradar.ru/), [R-Vision](https://rvision.ru/), and [USSC](https://www.ussc.ru/).

PHDays 11 wrap-up: interest in information security explodes, Rutube attack investigated, pipeline shutdown demo

**Positive Hack Days 11 will begin in a matter of weeks. This international forum on practical security will be held on May 18–19 in Moscow. The red and blue teams for The Standoff have already been formed, and we are putting the finishing touches to the [cyberrange](https://online.standoff365.com/) infrastructure and the conference [program](https://phdays.com/ru/program/speakers/).**

As per tradition, PHDays will have three big tracks dedicated to countering attacks (defensive), protection through attack (offensive), and the impact of cybersecurity on business. It is our pleasure to present the first talks.

### How to detect 95% of attacks covering 5% of threat actors' techniques

Oleg Skulkin, Head of Digital Forensics and Incident Response Team, Group-IB, will analyze a short list of techniques (used by almost all threat actors, no matter their sophistication) based on real-world attack scenarios. This provides detection opportunities even if there is very little data.

### IoC scoring

When dealing with indicators of compromise, analysts need to quickly understand the danger posed by the object in question. For this purpose, a special threat intelligence score is used. How exactly the vendor calculates it is often a commercial secret. Nikolay Arefiev, co-founder of RST Cloud, will explain how scoring works using the example of open indicators.

### If you have bootkits

When a computer is infected with viruses at the user level, you can use known methods of counteraction that rely on the kernel API. And what if the OS kernel itself or the firmware is compromised? Anton Belousov, Senior Specialist at Malware Detection, Positive Technologies, will talk about potential vectors of infecting BIOS- and UEFI-based systems with bootkits, and explain how to use the Xen–LibVMI–Drakvuf bundle to monitor malware behavior and what events or signs are indicative of an attempt to introduce a bootkit.

### Sanitizing the Linux kernel

In his report, independent information security researcher Andrey Konovalov will focus on KASAN implementation and practical usage, but will also briefly cover other sanitizers—the main tools for detecting bugs in the Linux kernel. KASAN detects memory safety issues: out-of-bounds and use-after-free bugs in slab, page\_alloc, vmalloc, stack, and global memory.

### Open-source intelligence

Andrey Masalovich, CEO, Inforus, will cover 20 practical OSINT techniques leveraging the opportunities of the digital age: image search using neural networks, collecting information from the dark web, detecting cloud storage leaks, tracking a user's digital footprint.

### Qualcomm BootROM

Vulnerabilities in BootROM, the most important component of hardware and software security, can lead to attackers gaining full control over the device. Independent researcher Dmitry Artamonov will discuss the role of BootROM in the Android smartphone boot chain. He will also talk about BootROM vulnerabilities of various mobile device vendors, share his experience of getting access to the JTAG interface in a Qualcomm smartphone, explain how to use it to extract the BootROM image from a modern device, and demonstrate successful exploitation of a one-day vulnerability in BootROM.

### Phishing on official websites

It is generally believed that fake websites are used for phishing. And if the site is genuine? What specific issues can lead to such consequences as website hacking? Independent information security researcher Aleksandr Kolchanov will give a number of examples of not just small companies easily falling victim to such phishing attacks, but large banks and airlines too. He will talk about common and lesser-known problems, including subdomain takeover and attacks on administrators of external services and on URL shorteners.

The co-organizer of PHDays 11 and The Standoff cyberbattle is the [Innostage Group](https://innostage-group.ru/). The business partners of the forum are [Security Vision](https://www.securityvision.ru/), a developer of cybersecurity solutions, [Rostelecom-Solar](https://rt-solar.ru/), a national provider of information security services and technologies, and [MONT](https://www.mont.com/ru-ru), a distributor of software for any business. The technological partner is [Azbuka Vkusa](https://av.ru/). The partners of PHDays 11 are [Axoft](https://axoft.ru/), [Fortis](https://fortis.ru/), [ICL System Technologies](https://www.icl.ru/eng/), [InfoWatch](https://www.infowatch.ru/), [Marvel Distribution](https://www.marvel.ru/en/), [R-Vision](https://rvision.ru/), [Gazinformservice](https://www.gaz-is.ru/), [Pangeo Radar](https://pangeoradar.ru/), [Jet Infosystems](https://jetinfosystems.com/?from=ru), Liberum Veritas, [IBS Platformix](https://platformix.ru/), and [USSC](https://www.ussc.ru/).

Stay tuned for [more updates](https://www.phdays.com/ru/press/news/)!

PHDays 11 talks: bootkit infection, sanitizers for the Linux kernel, the new face of OSINT, and phishing on official websites


Positive Hack Days 11 will begin in a matter of weeks. This international forum on practical security will be held on May 18–19 in Moscow. The red and blue teams for The Standoff have already been formed, and we are putting the finishing touches to the [cyberrange](https://range.standoff365.com/) infrastructure and the conference program.

As per tradition, PHDays will have three big tracks dedicated to countering attacks (defensive), protection through attack (offensive), and the impact of cybersecurity on business. It is our pleasure to present the first talks.

## How to detect 95% of attacks covering 5% of threat actors' techniques

Oleg Skulkin, Head of Digital Forensics and Incident Response Team, Group-IB, will analyze a short list of techniques (used by almost all threat actors, no matter their sophistication) based on real-world attack scenarios. This provides detection opportunities even if there is very little data.

## IoC scoring

When dealing with indicators of compromise, analysts need to quickly understand the danger posed by the object in question. For this purpose, a special threat intelligence score is used. How exactly the vendor calculates it is often a commercial secret. Nikolay Arefiev, co-founder of RST Cloud, will explain how scoring works using the example of open indicators.

## If you have bootkits

When a computer is infected with viruses at the user level, you can use known methods of counteraction that rely on the kernel API. And what if the OS kernel itself or the firmware is compromised? Anton Belousov, Senior Specialist at Malware Detection, Positive Technologies, will talk about potential vectors of infecting BIOS- and UEFI-based systems with bootkits, and explain how to use the Xen–LibVMI–Drakvuf bundle to monitor malware behavior and what events or signs are indicative of an attempt to introduce a bootkit.

## Sanitizing the Linux kernel

In his report, independent information security researcher Andrey Konovalov will focus on KASAN implementation and practical usage, but will also briefly cover other sanitizers—the main tools for detecting bugs in the Linux kernel. KASAN detects memory safety issues: out-of-bounds and use-after-free bugs in slab, page_alloc, vmalloc, stack, and global memory.

## Open-source intelligence

Andrey Masalovich, CEO, Inforus, will cover 20 practical OSINT techniques leveraging the opportunities of the digital age: image search using neural networks, collecting information from the dark web, detecting cloud storage leaks, tracking a user's digital footprint.

## Qualcomm BootROM

Vulnerabilities in BootROM, the most important component of hardware and software security, can lead to attackers gaining full control over the device. Independent researcher Dmitry Artamonov will discuss the role of BootROM in the Android smartphone boot chain. He will also talk about BootROM vulnerabilities of various mobile device vendors, share his experience of getting access to the JTAG interface in a Qualcomm smartphone, explain how to use it to extract the BootROM image from a modern device, and demonstrate successful exploitation of a one-day vulnerability in BootROM.

## Phishing on official websites

It is generally believed that fake websites are used for phishing. And if the site is genuine? What specific issues can lead to such consequences as website hacking? Independent information security researcher Aleksandr Kolchanov will give a number of examples of not just small companies easily falling victim to such phishing attacks, but large banks and airlines too. He will talk about common and lesser-known problems, including subdomain takeover and attacks on administrators of external services and on URL shorteners.

The co-organizer of PHDays 11 and The Standoff cyberbattle is the [Innostage Group](https://innostage-group.ru/). The business partners of the forum are [Security Vision](https://www.securityvision.ru/), a developer of cybersecurity solutions, [Rostelecom-Solar](https://rt-solar.ru/), a national provider of information security services and technologies, and [MONT](https://www.mont.ru/ru-ru), a distributor of software for any business. The technological partner is [Azbuka Vkusa](https://av.ru/). The partners of PHDays 11 are [Axoft](https://axoftglobal.ru/), [Fortis](https://fortis.ru/), [ICL System Technologies](https://icl.ru/eng/), [InfoWatch](https://www.infowatch.ru/), [Marvel Distribution](https://www.marvel.ru/en/), [R-Vision](https://rvision.ru/), [Gazinformservice](https://www.gaz-is.ru/), [Pangeo Radar](https://pangeoradar.ru/), [Jet Infosystems](https://jetinfosystems.com/?from=ru), Liberum Veritas, [IBS Platformix](https://platformix.ru/), and [USSC](https://www.ussc.ru/).

Stay tuned for more updates!

**Collectors no longer store works of art in safes—galleries and museums are now no less secure than the most impenetrable vaults. But can criminals steal a painting without leaving home?**

[PHDays 2022](https://www.phdays.com/en/) in May will see a revamped edition of The Standoff Digital Art: intrepid researchers will again try to steal cryptomasterpieces right there in the metaverse, while forum guests will be able to visit London without leaving Moscow.

Last year can be safely called the year of NFT. Trade on the NFT art market [reached](https://markets.businessinsider.com/news/currencies/nft-market-41-billion-nearing-fine-art-market-size-2022-1) $41 billion, coming close to the traditional art market. Tokens allow everyone to become owners of unique items. When artists, especially during lockdown, had new opportunities to sell their works, cybercriminals came knocking: phishing and exploitation of smart contract vulnerabilities are now all too common in the NTF sphere.Experts do not rule out the emergence of new methods of fraud in this market.

At The Standoff in November, white hats [managed to hack](https://standoff365.com/news/kiber-art-proverili-na-prochnost-on-ne-ustoyal/) the works of six Russian digital artists. [Desinfo](https://linktr.ee/desinfo), [Meta Rite](https://taplink.cc/meta%5Frite), [Artem Tkach](https://www.instagram.com/tkach%5Ftem/), [volv\_victory](https://linktr.ee/volv%5Fvictory), [Anomalit Kate](https://anomalitkate.com/ru), and [loiterkiddd](http://lynkfire.com/loiterkiddd) were brave enough to let their masterpieces be hacked. To steal a picture, cybersecurity researchers had to find vulnerabilities in smart contracts by analyzing the source code published in the Ethereum blockchain test network. Each NFT was hacked only once. Five of them succumbed to Alexey Bykhun in the first hours of the competition, and Alexey Egorov cracked the sixth.

_"Most smart contract vulnerabilities are related to the generation of a new collection. At this stage, each item in the collection is assigned a set of characteristics. Having learned to predict them, an attacker can intercept the rarest and most expensive NFTs outside the pricing rules.At PHDays 2022, participants will have to solve even more complex and interesting tasks than last year, and our competition will reach a cosmic level: together with Arcona, we will place digital artworks in augmented reality,"_ notes **Arseny Reutov, Head of Application Security Research, Positive Technologies.**

Paintings by Russian artists will appear in the virtual art galleries of Arcona XR Metaverse one week before the forum. The application will let you visit the digital exhibition from anywhere in the world.

_"Arcona XR Metaverse is a global augmented reality (AR) metaverse. It is based on a unique technology platform that automatically generates an AR layer anywhere in the world. On this layer, on digital land, different interactive projects can run simultaneously: games, historical reconstructions, tourist attractions. Such a large-scale ecosystem increases the demand for AR technology, making it mainstream. Armed with a digitized plot of land and a set of 3D models, the general user can place virtual content anywhere in the world in a few minutes, independently and remotely. All digital plots of land and content in the metaverse are designed as NFT assets, which makes the platform open for integration and partnership with any decentralized platforms,"_ says **Ilya Korguzalov, founder of Arcona XR Metaverse.**

Blockchain remembers everything. This is what hackers can exploit. The contestants will have to conduct their own investigation and find information that will allow them to take possession of digital paintings. 

The forum will also host a unique event: a thematic AR project launched in London remotely from Moscow! An interactive installation generated in a Moscow studio will unfold in front of the audience in the British capital.

Want to see it with your own eyes? [Welcome](https://phdays22.ruwidgets.ru/en/) to PHDays 2022!

PHDays 2022: cyberart is at risk. Again

Collectors no longer store works of art in safes—galleries and museums are now no less secure than the most impenetrable vaults. But can criminals steal a painting without leaving home?

PHDays 2022 in May will see a revamped edition of The Standoff Digital Art: intrepid researchers will again try to steal cryptomasterpieces right there in the metaverse, while forum guests will be able to visit London without leaving Moscow.

Last year can be safely called the year of NFT. Trade on the NFT art market [reached](https://markets.businessinsider.com/news/currencies/nft-market-41-billion-nearing-fine-art-market-size-2022-1) $41 billion, coming close to the traditional art market. Tokens allow everyone to become owners of unique items. When artists, especially during lockdown, had new opportunities to sell their works, cybercriminals came knocking: phishing and exploitation of smart contract vulnerabilities are now all too common in the NTF sphere.Experts do not rule out the emergence of new methods of fraud in this market.

Most smart contract vulnerabilities are related to the generation of a new collection. At this stage, each item in the collection is assigned a set of characteristics. Having learned to predict them, an attacker can intercept the rarest and most expensive NFTs outside the pricing rules.At PHDays 2022, participants will have to solve even more complex and interesting tasks than last year, and our competition will reach a cosmic level: together with Arcona, we will place digital artworks in augmented reality.

Paintings by Russian artists will appear in the virtual art galleries of Arcona XR Metaverse one week before the forum. The application will let you visit the digital exhibition from anywhere in the world.

Arcona XR Metaverse is a global augmented reality (AR) metaverse. It is based on a unique technology platform that automatically generates an AR layer anywhere in the world. On this layer, on digital land, different interactive projects can run simultaneously: games, historical reconstructions, tourist attractions. Such a large-scale ecosystem increases the demand for AR technology, making it mainstream. Armed with a digitized plot of land and a set of 3D models, the general user can place virtual content anywhere in the world in a few minutes, independently and remotely. All digital plots of land and content in the metaverse are designed as NFT assets, which makes the platform open for integration and partnership with any decentralized platforms.

Blockchain remembers everything. This is what hackers can exploit. The contestants will have to conduct their own investigation and find information that will allow them to take possession of digital paintings.

The forum will also host a unique event: a thematic AR project launched in London remotely from Moscow! An interactive installation generated in a Moscow studio will unfold in front of the audience in the British capital.

Want to see it with your own eyes? Welcome to PHDays 2022!

**The pandemic was followed by a real epidemic of cyberattacks, making the [PHDays forum](http://phdays.com/en/) more relevant than ever in the new reality. As ever, there won’t be a dull moment. In addition to in-depth talks on information security, you will witness [The Standoff cyberbattle](http://standoff365.com/), while the wide range of contests will not only keep you entertained, but deliver new knowledge and valuable experience. The competitions are open to all interested researchers. You can take part online or offline.**

Last year, there were a lot of venturous participants: each of the five contests at PHDays X gathered dozens of information security enthusiasts—a total of more than 200 people. This time, we want to attract even more, so we have refined and updated the formats of our contests. 

Artificial intelligence (AI) technologies have already become a part of our lives. The kidding is over. Now that cybercriminals have started using deepfakes in their attacks, AI is no longer a gimmick, rather the source of new incidents, some curious, some terrifying. At the AI Track, participants will hear talks on the role of AI in security, as well as on the security of AI itself. AI experts will share their experience in using machine learning (ML) for protection, and researchers will talk about the risks of AI-based solutions. The AI CTF competition will acquaint information security specialists with various ML techniques and vulnerabilities in CTF gaming services. The tasks of varying difficulty levels will fascinate both experienced CTF players and beginners.

In the Payment Village, you can try your hand at finding vulnerabilities in banking systems. Our experts will tell you about various payment devices and their protection flaws. After getting acquainted with the theory, you’ll have the chance to test the security system of a real ATM, cash register system, or POS terminal. Even those without their own laptop can still take part.

At the IDS Bypass stand, you can put a real network protection system through its paces. Not only will participants have to find weaknesses in six services and get flags for fulfilling certain conditions, but also bypass an intrusion detection system (IDS), which allows traffic through and blocks attempted network attacks. Vulnerable services are selected so that competitors focus their efforts on bypassing the IDS, and the number of possible solutions is unlimited.

Such contests have been chosen for a reason. Cybercriminals, with their rich imagination, can weaponize any payment terminal, allowing them to attack banks and cardholders alike. And as the boom in biometrics continues, we can expect ever more deepfakes and other AI-related challenges in the near future.

The PHDays 2022 program does not end there. Far from it. [HackerToon](https://phdays.com/ru/press/news/zalipaj-na-hackertoon-festival-animacii-na-phdays-2022/), an experimental animation festival, and the final of the first [All-Russian open-source project competition](https://phdays.com/ru/press/news/phdays-2022-primet-final-vserossijskogo-konkursa-open-source-proektov/) for schoolchildren and students await forum visitors and participants. In addition, music will feature heavily at PHDays: the finalists of the [Positive Wave](https://phdays.com/ru/press/news/phdays-muzykalnyj-festival-positive-wave-vozvrashchaetsya/) festival will perform, and a well-known Russian musician will play AI-composed tracks.

The co-organizer of PHDays 2022 is InnoSTage Group, a key cybersecurity player. The business partners of the forum are [Rostelecom-Solar](https://rt-solar.ru/), a national provider of information security services and technologies; [MONT](https://www.mont.com/ru-ru), a distributor of software for any business; and [Security Vision](https://www.securityvision.ru/), a developer of cybersecurity solutions. The partners of PHDays 2022 are [Axoft](https://axoft.ru/), [Fortis](https://fortis.ru/), [ICL System Technologies](https://www.icl.ru/), [InfoWatch](https://www.infowatch.ru/), [MARVEL Distribution](https://www.marvel.ru/), [R-Vision](https://rvision.ru/), [Azbuka Vkusa](https://av.ru/), [Gazinformservice](https://www.gaz-is.ru/), and [Pangeo Radar](https://pangeoradar.ru/).