News
PHDays III Contests Program: Hacking ATM and SCADA, Passing the Labyrinth
The participants of Positive Hack Days, which will be held in Moscow on May 23-24, will hear the reports of well-known experts in information security, partake in hands-on labs, support a CTF team — and this is not all there is to it. The forum guests will have the opportunity to try themselves in fascinating competitions. We would like to bring to you attention the list of contests that will take place during Positive Hack Days III at the WTC Moscow. Contests held at the venue Please note that it is necessary to bring your laptop with you to take participate in most of the contests. Choo Choo Pwn The contestants will be offered to choose access to communication systems of industrial equipment or HMI systems. The goal is to independently obtain access to a model of a control system of a railroad and cargo re-loading by exploiting vulnerable industrial protocols and to bypass SCADA systems authentication or industrial equipment web interfaces. There will be video surveillance, and, as an additional task, the competitors will be offered to affect the surveillance system. Labyrinth Labyrinth is the most unusual and large-scale amusement ride in the history of PHDays. Anyone will have the opportunity to try themselves in the art of hacking: to get over the laser field and motion detectors, try skills in security analysis of present-day information systems, remove bugs, combat with artificial intelligence and render a bomb harmless. To get through the Labyrinth, the participants will need some skills in dumpster diving, lock picking, application vulnerabilities detection, social engineering, and of course there is no way without sharpness of mind and physical fitness. Leave ATM Alone The competition challenges the participants' skills in exploiting various vulnerabilities in ATMs. The software is developed for PHDays III and does not exist in real life, but it contains most types of vulnerabilities in such systems. The contest consists of two rounds: first, the participants search and exploit vulnerabilities in the ATM system, and then the finalists are to perform similar tasks being constrained by time. $natch During the competition, the participants check their skills in exploiting common vulnerabilities in web services of the remote banking system. Real vulnerabilities in the I-bank system applications, which were discovered by the Positive Technologies specialists during security analysis if such systems, will be presented in the contest. The contest consists of two rounds. Virtual machine copies with vulnerable web services of the remote banking system (a real I-banking system analog) will be provided to the participants. During the time defined by the organizers, the participants should discover vulnerabilities in the system. Then the participants should exploit the vulnerabilities they discovered to withdraw funds. Wipeout This year, every guest will have an opportunity to view him- or herself as Dade Murphy from Hackers. Anyone will have the opportunity to compete in controlling a futuristic bolide in arcade racing. Lockpicking This Lockpick Village will be presented by Deviant Ollam, Babak Javadi, and Keith Howell, members of TOOOL, The Open Organisation Of Lockpickers. New applicative knowledge, interesting practical problems and many challenges are waiting for the guests of the forum. Fox Hunting The participants are offered to detect of wireless access point 802.11 a/b/g/n with a known ESSID identifier. The access point location will change from time to time. The participants should identify exact coordinates of the current location of the wireless access point (a fox) and notify the organizers. The participant who catches more foxes than others do, wins the contest. 2600 The goal is to call a certain number from a coin-box telephone. The coin should be returned to the organizers. The results of the contest will be announced on the second day of the forum. The originality of the method being used to complete the task will be considered. The participants are not allowed to perform any actions that may damage the coin-box telephone. Big Shot A participant of the contest will receive a photo of a person (it won't be easy to identify the person pictured) and certain features of the person. The person will be present at the forum and the participants should identify him or her and perform certain actions (for example, to get his or her business card or to get him or her photographed). 2drunk2hack The participants should perform an attack against a web application equipped with a security filter. The application contains a finite number of vulnerabilities, the exploitation of which allows executing the operating system commands. The contest total time is limited to 30 minutes. Every 5 minutes the participants those participants who attacked WAF more often are offered to have a drink and then continue. The participant who receive the main flag when executing commands on the server, wins the contest. Best T-Shirt There is no need to be an expert in information security to partake in the forum contests, rich imagination can fix the problem. The one who wears the coolest hacking T-shirt will get the prize from the forum organizers. The contests winners and participants will get presents from Positive Technologies, the Positive Hack Days organizers. Anyone will be able to prove himself! You can register to participate in Positive Hack Days III on the RUNET-ID site. Online contests Those who won't be able to be present at the forum in the WTC Moscow can participate in online contests. Hash Runner The contest challenges the participants knowledge in hashing algorithms and skills in hacking passwords hash functions. The competitors are given a list of hash functions generated according to various algorithms (MD5, SHA-1, Blowfish, GOST3411, etc.). To win the competition, a participant is to score as many points as possible during a limited period of time, leaving the competitors behind. The competition is open for any Internet user. Registration will be opened on phdays.ru a week before the forum starts. Competitive Intelligence During the contest the participants will find out how good they are at searching information in the Internet. Questions related to a certain organization will be published on the contest's page. The goal is to find as many right answers to these questions as possible for a short period of time. The results will be announced at the end of the second day of the forum. The competition is open for any Internet user. You can register on phdays.ru (registration will be opened a week before the forum starts). PHDays HackQuest Organizer: @ONsec_Lab (http://onsec.ru) Everybody is welcome to participate in the hacking competition PHDays HackQuest http://hackquest.phdays.com. A good mood and perfect brain training are guaranteed! We will try to make you sink into the almost forgotten world of DOS and 8-bit music, to evoke nostalgic feelings and fill you with positive emotions facing the international forum PHDays III. Date: May 1-13, 2013 The winners will receive keepsakes and tickets to the international forum on information security PHDays III. Prizes: 1st place: 5 tickets + 5 T-shirts 2nd place: 4 tickets + 4 T-shirts 3rd place: 3 tickets + 3 T-shirts 4th—10th places: 1 ticket + 1 T-shirt A special prize for a bonus task is 1 ticket and 1 T-shirt.
PHDays III Young School Finalists are Known
For the second year in a row, we hold the competition in order to find young and talented specialists in information security who will be able to raise the science level of the country of the famous Russian hackers. The competition of young scientists is held as a part of the Positive Education program. The initiative is to expand the knowledge that young scientists got at the university and to introduce the unique experience of practical security gained by the Positive Technologies experts. Students, postgraduates and independent young researchers can partake in the competition. The applications accepting lasted for 3 month. This week the finalists have been defined. Program committee includes the leading IS experts from Advanced Monitoring, ERPScan, Yandex, Hacker Magazine, MSU Faculty of Computational Mathematics and Cybernetics, MEPHI, SPIIRAS, Technical University of Darmstadt, University of Tübingen, Russian Defcon Group. It considered a great many of applications and selected the four best works. The finalists of this year: Nikolay Tkachenko (Tomsk) provided a research on "Development and Implementation of Mandatory Access Control Mechanism in MySQL" Andrey Chechulin (St. Petersburg) and a research on "Construction of Attack Graphs for Security Events Analysis" Ksenia Tsyganok (Taganrog) prepared a report on "Statistical Analysis for Malware Classification" Andrey Iskhakov (Tomsk) and a research on "Two-Factor Authentication System Based on QR Code" For more information about the finalists, visit the PHDays website. The winners of Young School will be named at Positive Hack Days. Jury This year the program committee includes: Dmitry Kuznetsov, Deputy CTO at Positive Technologies Andrey Petukhov, MSU Faculty of Computational Mathematics and Cybernetics Denis Gamayunov, MSU Faculty of Computational Mathematics and Cybernetics Alexey Smirnov, Parallels Alexey Kachalin, Advanced Monitoring Vladimir Ivanov, Yandex Stepan Ilyin, Hacker Magazine Eugene Rodionov, MEPHI Pavel Laskov, University of Tübingen Alexander Polyakov, ERPScan Alexey Sintsov, Russian Defcon Group Alexandra Dmitrienko, Technical University of Darmstadt Igor Kotenko, SPIIRAS Peter Volkov, Yandex Dmitry Oleksiuk, independent developer Nikita Abdullin, OpenWay Positive Hack Days will be held on May 23-24 at the WTC Moscow. Register to visit the forum and see how they forge the future of the Russian science.
Positive Hack Days III — Ticket Sale Has Started
Ticket sale for the international forum on practical security PHDays III started on Monday, April 8. Registration and tickets are available here. A ticket bought until May 1 will cost 9,600 rubles per two days and 7,100 rubles per a day. After May 1 the price of a ticket will increase up to 13,700 rubles per two days and 9,600 rubles per a day. It is worth reminding that there are other ways to join the forum beside the ticket purchase — just prove yourself in any of the contests (keep up with the news on the official website) or become a speaker registering via Call for Papers until April 14. Similarly to the forum held last year, anyone, who wants to, can organize PHDays in their own city — study the requirements to the participants of PHDays Everywhere at first. Live broadcast will be available for all Internet users. Find the details about the ways of participation in PHDays III on the forum's website.
PHDays III Will Take Place in World Trade Center Moscow
The third international forum on practical security Positive Hack Days will take place on May 23-24 in the Moscow World Trade Center, one of the main platforms of the country. All the participants' requests and the new level of the event have been considered by the organizers to choose the right place. This year the forum will host at least 2,000 experts comparing with 1,500 experts last year. The number of various reports, contests, and hands-on labs will increase significantly as well. We'll keep other secrets just for now. It's only worth saying that a lot of unexpected and unforgettable experiments related to the development of the IS industry are in store for the guests and participants of PHDays III. The event focuses on mind labyrinths, where information technology development brings us. The new place for PHDays III to be held is designed for events of any scale and character. The WTC Congress Center located on Krasnopresnenskaya Naberezhnaya is the most in-demand and prestigious congress and exhibition place in Russia. It hosts the most important events of the country — from information technology exhibitions to meetings with state leaders. WTC meets all the demands of PHDays III both in space capacity and comfort and in equipment. This ultra-modern conference platform is equipped with high-tech gadgets. In 2010 the WTC received International Arch of Europe for Quality and Technology Award for the use of the most up-to-date technologies and implementation of modern management methods. Of course, the PHDays team will have to work hard to make a 36-hour hacking range out of this exhibition platform, but all we need is close at hand. The WTC provides space for professional discussions, business negotiations, and for the most recent techniques of network hacking being demonstrated by the leading world hackers. P. S. Please note that the date has been changed — the forum will be held on May 23-24.
PHDays III Call For Papers: The Latest Intelligence Data on either side of a fence
The first wave of the Call for Papers has already yielded its results: specialists from different countries are ready to be loaded onto the plane to the PHDays III. Both reports and hands-on-labs (where the audience is able to participate) will be presented at the forum. Today we are ringing up the curtain to tell you about several reports taking place at the forum. Special Guest Stars Among special guests at the forum are: Travis Goodspeed,who we all know, and ReVuln's founders, Donato Ferrante and Luigi Auriemma, known for their researches in information security ofSCADA and Smart TV. Data Interception within Optical Fiber Networks Alexey Demenyuk (FixedBug's founder) together with Vladimir Grishachev and Dmitry Khlyapin in their report "Sound at the end of the tunnel" will demonstrate data interception methods within optical fiber network without its tapping. The speaker will raise a question on how reliable the optical fiber networks are considering security issues and will also contemplate current security threat, based on physical properties of the optical fiber. During the lecture, data interception within optical fiber network without its tapping will be demonstrated. If the Psychological Warfare can not be Stopped, it Should be Headed Andrey Manoilo (vice-chancellor at the Political Science Department at Moscow State University and editor-in-chief of Mir i Politica) will have a detailed look at the two main concepts of state policy implementation under the conditions of the psychological warfare: psychological warfare resistance and control. Upon the speaker's opinion, psychological warfare control soon will be the main category in the state information policy system. Cyber War of a Chinese Hacker, Black Economy, and Trojan Tool China's billion-plus population means that proportionally, there are a lot of hackers in China. Nonetheless, you can't say enforcement is non-existent in China. What happened to China hackers in the last ten years? Who are they and what do they want? Tao Wan, also known as Eagle Wan, the leader of the China Eagle Union will give you the truth. Airlines against hackers Security flaws associated with business process management could be a serious threat for companies. Mushtaq Ahmed, a specialist of IT Security&Risk Management department in Emirates Airline, will present a report "Software Development Life Cycle with a Tinge of Application Security". He will take up application security aspects, and flaws in business process management that could have a pernicious effect on the business effectiveness. Hackers against airlines? During a short speech "Experiments with entertainment systems on board of aircratfs", gentlemen from Anonymous and Bnonymous will show how the Internet works on the board of an aircraft, what is a strange box with video on the back of the seat before you, and what you could do with it to spend your time cheerfully and profitably during the flight. How to "sell" the security improvement tools Jerry Gamblin, an employee in House of Representatives, Missouri, whos report in PHDays 2012 was favoured by Anonymous, will show how to protect your work from the management and lobby for new projects. Hacking Services Underground Market Max Goncharov, Senior Threat Analyst at Trend Micro, will represent his report Underground Market 101: Pricing Stats and Schemas. The speaker will cover the principles of underground information exchange, ways to secure money/goods in underground transactions and basic cyber hierarchy. Crypt services, DDoS attacks, Traffic resale, Bulletproof servers, SMS Fraud, Spam services and Credit card Hijack — these topics will also be covered. Hack on level 8 Gathering enough data about systems and staff from the public resources (Open-Source Intelligence, OSINT) is often essential in security audit, and is also critical for audit success based on social engineering methods. To confirm this statement, Vladimir Styran, a well-known blogger (), Security13 podcast presenter (), will present a report about OSINT automation methods by free of charge or paid means. Abusing Browser User Interfaces for Fun and Profit Rosario Valotta, a security researcher from Italy known for demonstration of zero-day vulnerabilities in Internet Explorer, will raise the question of exploitation of user interfaces flaws. The speaker will show how notification bars in major browsers (Chrome 24, IE9, IE10) can be abused with little (or even no) social engineering, leading to users security compromise and even to conducting trivial code execution on the victim's machine. Attack modeling, security assessment metrics and visualization in promising SIEM systems Igor Vitalievich Kotenko (head of information security issues laboratory, SPIIRAN) will present the current research in SIEM systems. The report includes aspects of software implementation for an SIEM system of the next generation, developed as a part of the integrated project of The Seventh Framework Programme ( FP7), and also attack modeling and security protection issues. NFC new threats Nahuel Grisolía will present "RFID workshop for fun (and profit?;)" workshop that introduces vulnerabilities in NFC (Near Field Communication) wireless technology. The range of topics will vary from the use of traditional NFC 13.56 MHz readers, their API and proprietary software, to Proxmark3 hardware, open source software (LibNFC), known attacks and other RFID uses and practical ideas. How to develop a secure web application? Vladimir Kochetkov from Positive Technologies is going on with secure application development and presents hands-on lab "How to develop a secure web application and stay in mind?". The target audience is web application developers and researchers that want to improve skills in code and architecture security and Security Development Lifecycle for complex projects based on Microsoft ASP.NET technologies (Web Pages, Web Forms, MVC, Entity Framework, SignalR). The hands-on lab is based on real vulnerabilities in popular solutions. It considers the best practices and techniques of detection and elimination of vulnerabilities of all classes on each stage. Sqlmap: Under the Hood Miroslav Štampar is a professional software developer from Croatia, an expert in automation of SQL Injection. He will present in-depth analysis of capabilities and inner workings of sqlmap. Hands-on lab is devoted to peculiarities and hidden features of sqlmap. Hard logic for security A Berlin University of Technology (TU Berlin) PhD-student and Deutsche Telekom researcher Dmitry Nedospasov together with Keykeriki developer, Thorsten Schroder, will make «Let the „hardware“ Do All the Work: Adding Programmable Logic to Your Toolbox" report. They will report how to avoid common issues in coping with overwhelming amounts data and timing using FPGA tools matrix, that is a basis of high-end tools for hardware debugging and analysis. So Insecure Security Appliances Stefan Viehböck with his report (In)security of Appliances will lift the curtain over the vulnerabilities of security software and will demonstrate how security appliances suddenly become the weakest link of your defense, how to abuse security appliances to gain access to your network, to your data, and your crown jewels. The speaker promises to disclose world-shattering vulnerabilities in security appliances. As a part of Fast Track: Alexander Tovstolip and Alexander Kuznetsov will show ten methods to overcome DLP Systems. Artyom Poltorzhitsky together with Vladimir Konev will show the high-end bank spy for smartphones. One of the most important elements of an up-to-date virus is an antivirus system bypass module, which makes the conventional signature approach and heuristic analysis give in. To solve this problem, a lot of vendors of IS tools launched cloud reputation systems. Pavekl Korostelev's report analyzes functions of such services. How to Participate If you want to speak to the world leading IS specialists, share your experience and research results, or demonstrate your skills in practical information security, you are welcome the speakers' team of PHDays III. Do not waste your time — the later the date of your application, the fewer chances you have to be among the speakers. The second stage of Call for Papers will be over on April 14, 2013. Find the details about the format and participation rules, as well as the list of topics we are mostly interested in and application submission instructions on the PHDays website.
Last Two Weeks to Take Part in PHDays Young School!
By popular demand, we increase the time frame for young scientists in information security to send in the reports and take part in the contest. Now you can apply for participation in PHDays Young School until March 15, 2013 (24:00 UTC). We have already received applications for participation that are based on such current tendencies as information warfare, mobile platforms vulnerabilities, anonymity, and mobile devices. The contest finalists will be invited to participate in Positive Hack Days III to present their reports. A pleasant detail: transportation and accommodation costs will be refunded. Take the opportunity of telling the world about your researches. We are looking forward to receiving your report!
PHDays CTF Quals — 494 Teams from 30 Countries and PPP Triumph
PHDays CTF Quals — 494 Teams from 30 Countries and PPP Triumph This year PHDays CTF Quals, information security competition, has become the most large-scale over its history — 681 teams applied for participation, 494 of them took up the struggle, 154 teams solved at least one task, and more than 100 people discussed the battle on IRC. PPP (Plaid Parliament of Pwning), a team from the USA, became the winner. According to the results of the competition that lasted over 48 hours from 10 a.m. on December 15 to 10 a.m. on December 17, the first 10 teams of the overall rating, which scored the biggest number of points for the least time, qualified for PHDays III CTF.
Three Days Left Before PHDAYS CTF Quals Starts
Let us remind you that PHDays CTF Quals starts on the 15th of December and will last for three days. 300 teams from more than 30 different countries of the world have already registered. You still can join! Registration for Quals: till 17th of December, 2012. Time when Quals will be held: From 10 a.m. of the 15th of December till 10 a.m. of the 17th of December, 2012 (Moscow time). The contestants will try their hands at security assessment, vulnerabilities detection and exploitation, as well as fulfilling reverse engineering tasks. The conditions of PHDays CTF Quals, as opposed to many other competitions of the kind, are brought as close to real life as possible — all the vulnerabilities are not fictional, but indeed occur on present-day information systems. The winners of the contest will be those who gain the highest score earlier than others. On the basis of the PHDays CTF Quals results, the strongest teams will be invited to participate in PHDays III CTF. The main contest will take place on the 22nd and 23rd of May, 2013 in Moscow during the third international information security forum Positive Hack Days.
PHDAYS CTF Quals Hacking Competition Starts
For the attention of information security specialists, system administrators, developers — all those, who is familiar with vulnerabilities detection and is ready to demonstrate their skills in a hacking battle! PHDays CTF Quals (the qualifying stage of the PHDays CTF international information security contest) starts in December. The contestants will try their hands at security assessment, vulnerabilities detection and exploitation, as well as fulfilling reverse engineering tasks. The conditions of PHDays CTF Quals, as opposed to many other competitions of the kind, are brought as close to real life as possible — all the vulnerabilities are not fictional, but indeed occur on present-day information systems. The winners of the contest will be those who gain the highest score earlier than others. On the basis of the PHDays CTF Quals results, the strongest teams will be invited to participate in PHDays III CTF. The registration for the quals starts on the 28th of November and finishes on the 17th of December, 2012. PHDays CTF Quals will take place from 10 a.m. of the 15th of December till 10 a.m. of the 17th of December, 2012 (Moscow time). The main contest will take place on the 22nd and 23rd of May, 2013 in Moscow during the third international information security forum Positive Hack Days. How It Was Among last year's quals participants there are teams from Russia, USA, Japan, Ukrane, Netherlands, France, South Korea, Tunisia, Germany, Switzerland, Kenya, Canada, Peru and Great Britain. The first prize went to the rdot.org team from Saint-Petersburg. The final CTF 2012 contest with 300,000 rubles of prize money became a real barnburner of the second PHDays forum, organized by Positive Technologies. During two days and one night non-stop, 12 teams from 10 countries were hacking their rivals' networks and protecting their own resources. The Leet More team from Russia became the winner, they were awarded with 150,000 rubles, the second prize (100,000 rubles) was taken by 0daysober from Switzerland, and the third prize (50,000 rubles) went to the Spanish team int3pids. A large analytical study of PHDays CTF 2012 is available here. Details You can learn more about PHDays CTF Quals and register by following the link http://quals.phdays.com.
Positive Hack Days III On The Way! Call For Papers Announced
Please attention! It has been finally decided to hold Positive Hack Days III. Positive Technologies, the permanent organizer of the event, has already started preparing for the third international forum on practical information security. The forum will take place in Moscow on May 22-23, 2013. The rules remain the same: maximum experience, minimum ceremonies, no advertising materials or dull promotion. Call For Papers The guests of PHDays III - will see a lot of round tables, contests, competitions, workshops, hands-on labs, and surely many reports presented by information security specialists from all over the world. You can be among the reporters. There are no strict restrictions: anyone from a novice to a recognized expert in information security can apply for participation. Our goal is to facilitate animated, informal communication between all representatives of the information security industry. The main requirements are an interesting topic concerning information security, novelty and urgency of the issues under consideration, professionalism and competence. If you want to share your experience, research results or demonstrate your skills, then we will be waiting for you in Moscow at the end of May 2013. Without you the forum will fell through! Hurry up — the first stage when you can submit your application is from October 29, 2012 to January 27, 2013. It is worth reminding that in 2012 the forum brought together 1,500 specialists from all over the world. More than 50 reports, workshops, seminars, and round tables took place there. Legendary Bruce Schneier, Datuk Mohd Noor Amin, the chairman of IMPACT, Alexander (Solar Designer) Peslyak, Travis Goodspeed, and Alexander Gostev were among the speakers. Any details about the formats and participation rules, the most interesting topics for reports, instructions for call for papers are available here