Michael Hamm, CIRCL
Since the year 2000 Michael Hamm works for 10 years as Ingenieur-Security in the field of classical Computer- and Network-Security (Firewall, VPN, AntiVirus, …) at the research center “Henry Tudor” in Luxembourg. Since 2010 Michael works as operator for the Computer Incident Response Center Luxembourg. Here he is working on forensic examinations, incident response and analysis.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 16:35-17:05
Hosted by Team S2 Grupo
MD5: dafa6a7880ddd0b5a3443fdc3024675f
Format: application/pdf
Last Update: February 1st, 2017
Size: 1.44 Mb
Chris Romeo (Security Journey)
Romeo-Chris-Appsec-Behaviors.pdf
MD5: 38ee4c53112b1d8bc0b08b8d55e039a3
Format: application/pdf
Last Update: April 25th, 2017
Size: 1.35 Mb
Foy Shiver, APWG
Foy Shiver is Deputy Secretary-General of the APWG (Anti-Phishing Working Group) and one of the founding directors of APWG.EU, a European foundation headquartered in Barcelona. In 2004 Mr. Shiver assumed management of operations of the nascent non-profit Anti-Phishing Working Group. He has helped develop this organization into a global industry, law enforcement and research group dedicated to countering the growing threat of electronic crime. In 2005, Mr. Shiver accepted the appointment as Deputy Secretary-General of APWG for which he is charged with cultivating the membership base around research, education and policy issues to fight cybercrime and electronically mediated fraud. In this role Mr. Shiver has worked since 2006 to grow APWG’s eCrime Research Summit into an annual event that has published 75+ peer reviewed cybercrime research papers through IEEE. In that brief, he founded its scholarship program that is now funded, in large part, by the IEEE-SA. In 2013 Mr. Shiver worked with APWG and CaixaBank in Spain to found the new European Foundation APWG.EU. This foundation is harnessing resources focused on cybercrime research and education within the European Union and plays a leadership role in inspiring cybercrime research across the globe.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 10:50-11:35
Hosted by Team S2 Grupo
MD5: ec7588ef8812824dd0539cd93d090984
Format: application/pdf
Last Update: February 1st, 2017
Size: 2.76 Mb
Lisa Bradley (NVIDIA), Christopher Robinson (Red Hat)
MD5: f8cc3114a51c3e01d66e7c5c1c7a989a
Format: application/pdf
Last Update: April 25th, 2017
Size: 4.66 Mb
Daniel Adinolfi (The MITRE Corporation)
FIRSTPSIRT-CVE_and_CNA_program.pdf
MD5: c2f67ab6a29edfa56f8af6fa98729ab3
Format: application/pdf
Last Update: April 25th, 2017
Size: 679.82 Kb
Vic Chung (SAP)
Evolving-role-of-PSIRT-in-the-Cloud.pdf
MD5: 3bdf083b1c66118336efb20e80df6875
Format: application/pdf
Last Update: April 25th, 2017
Size: 1.61 Mb
Janis Dzerins, CERT.LV
After the announcement of Kryptowire about the several models of Android mobile devices that contained firmware which collects sensitive personal data about users and transmits the data to third-party servers without users' consent, CERT.LV and CERT-EE conducted a joint research on the Android mobile phones used in the government networks. In this talk we share our experience and discoveries. (TLP:GREEN)

J?nis Džeri?š has been interested in computers since early school years. Since then he has been learning all things computer-related, and working professionally as a programmer. The endless pressure to deliver features at the cost of quality and security has lead him to reevaluate his priorities and join the CERT.LV team at the end of summer of 2016. He assures everybody this has nothing to do with midlife crisis.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 23, 2017 14:45-15:15
Hosted by Team S2 Grupo
MD5: 0e8229e75b2e7aa11b491ded66d8c389
Format: application/pdf
Last Update: February 1st, 2017
Size: 1.12 Mb
Feike Hacquebord (Trend Micro)
Throughout history, politically motivated threat actors have been interested in changing the public opinion. In recent years the popularity of the Internet gave these threat actors new tools that are highly effective and scalable. Not only do they make use of social media to spin the news, spread rumours and fake news, but they also actively hack into political organisations. In this talk we will give an overview of the attack tools that political motivated actors use. We will give explicit examples of advanced credential phishing, leaking sensitive data and attempts to influence what mainstream media publish. We will also discuss networks that are designed to spread rumours and fake news on social media. Cyber attacks against political organisations are not likely to stop anytime soon. Our presentation we will include recommendations for organisations to protect themselves from the most prevalent attacks politically motivated actors use.
How_politically_motivated_actors_attack.pdf
MD5: 1f343576f1f5980b700369f180c1fc64
Format: application/pdf
Last Update: May 4th, 2017
Size: 15.3 Mb
Mirjam Kühne & Ivo Dijkhuis, RIPE NCC
RIPEStat is a tool that provides information about any given IP address space, Autonomous System Numbers (ASNs), and related information. It presents registration and routing data, DNS data, geographical information, abuse contacts, blacklists and more from the RIPE NCC's internal datasets as well as from external sources. RIPE Atlas is the largest active Internet measurement network with almost 10,000 probes connected worldwide. The data produced by this infrastructure can be used to understanding of the state of the Internet in real time. We will present the latest developments of these tools and show how they can be used for online investigations.
Mirjam Kühne is the Senior Community Builder at the RIPE NCC, a role she’s held since 2009. She collaborates with various technical, security and academic peers within her extensive professional network to strengthen the Internet community within the RIPE NCC’s service region.
Mirjam also maintains and curates RIPE Labs, a collaborative platform that supports innovative ideas and tools for the Internet.
Prior to her current role with the RIPE NCC, Mirjam worked at the Internet Society as a Senior Program Manager. She was involved in issues related to technology and public policy, bridging the gap between the technical community and a non-technical audience like government representatives. Mirjam also developed and organised technical workshops primarily in developing countries. One of her tasks was to establish and maintain relationships with partner organisations (ICANN, the RIRs, the IETF, NSRC and others) and regional and local operator communities.
The start of Mirjam’s career in the Internet industry actually began with the RIPE NCC. She worked there for nine years, the latter half as part of the senior management team, contributing to the organisation’s strategic and financial planning. She was responsible for external relations and represented the organisation on an international level. Before that, Mirjam was responsible for developing and managing membership as well as public services.
Mirjam obtained a Masters of Computer Science at the Technical University Berlin, Germany.
Ivo Dijkhuis, RIPE NCC
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 09:35-10:00
Hosted by Team S2 Grupo
dijkhuis-ivo_kuhne-mirjam_slides.pdf
MD5: 4bceab2e7339e06c76c7e13d81b6b211
Format: application/pdf
Last Update: February 1st, 2017
Size: 3.85 Mb
Chris Romeo (Security Journey)
MD5: 32930b1915af1a69ba4db496b4213c0b
Format: application/pdf
Last Update: April 25th, 2017
Size: 2.37 Mb
Javier Berciano, CERTSI
Javier Berciano works as Head of Incident Response at Spanish National CERT (Security and Industry CERT - CERTSI, formely known as INTECO-CERT). He is focussed on incident response, computer forensics, threat analysis and monitoring, as a team leader.
It takes more than a decade professionally dedicated to computer security. He held some cybersecurity certifications as CISSP, GCFA, GNFA, CISA, etc.
He has also participated as speaker in some international conferences like FIRST Conference and Symposiums, Microsoft DCC, National CSIRT meetings, TF-CSIRT, Trusted Introducer, Microsoft DCU Threat Intelligence, ABUSES forum, ENISE, etc.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 16:05-16:35
Hosted by Team S2 Grupo
MD5: e25e27bce8495208e3289765e05da38a
Format: application/pdf
Last Update: February 1st, 2017
Size: 2.8 Mb
Thomas Attema (TNO)
Internal network traffic is an undervalued source of information for detecting targeted attacks. Whereas most systems focus on the external border of the network, we observe that targeted attacks campaigns often involve internal network activity. To this end, we have developed techniques capable of detecting anomalous internal network behavior. As a second contribution we propose an additional step in the model-based anomaly detection involving host clustering. Through host clustering, individual hosts are grouped together on the basis of their internal network behavior. We argue that a behavioral model for each cluster, compared to a model for each host or a single model for all hosts, performs better in terms of detecting potentially malicious behavior. We show that by applying this concept to internal network traffic, the detection performance for identifying malicious flows and hosts increases.
Internal_Network_Monitoring_and_Anomaly_Detection.pdf
MD5: 8b8de9150fdc5d658f8f2fad11d45ac8
Format: application/pdf
Last Update: May 4th, 2017
Size: 3.88 Mb
Jose Enrique Hernandez (Zenedge)
The talk aims at first dissecting some recently targeted bot attacks we have faced at Zenedge and walk through the capabilities of a determined threat actor. Expanding upon the chess game of mitigation we pivot into the 5 main mitigation techniques:
Then discuss their pros and cons, and what combination is most effective against targeted attacks. In the final section of the talk will discuss how to employ these techniques and have them leverage by your very own CIRT team. The talk will close off with advice/guidelines to follow in order to detect, mitigate and report on bot attacks using open source software.
Tatsuya Ichida (Recruit Technologies)
I introduce the deep customized sandbox system for CSIRT. This has some individual functions in order to make forensic easier. We had considered what CSIRT wants via malware analysis. Finally, our CSIRT's dream come true. Our system has the functions below.
This system help Recruit-CSIRT on the both of Forensic and Prevention. Normal behavior and traffic removing is very tough and still now on going. Our system is a kind of enhanced cuckoo sandboxes.
Recruit-CSIRT_TatsuyaIchida.pdf
MD5: 9986dbbc990fe06b98e1a56a34e143b3
Format: application/pdf
Last Update: April 27th, 2017
Size: 3.71 Mb
Francisco Sucunza, InnoTec System - Entelgy Group
Cyber-security Project Manager at InnoTec (Entelgy group) and passionate about information technologies, Francisco Sucunza has been involved international IT security projects for companies such as Telefónica or Repsol. With a strong background in Sciences he has led his career to project management but still keeping a foot in both camps.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 14:20-14:50
Hosted by Team S2 Grupo
MD5: 75292845c72c3b7ac415bc2b9cebf121
Format: application/pdf
Last Update: February 1st, 2017
Size: 5.89 Mb
Brian Willis (FIRST)
Multiparty-Coordination-Disclosure.pdf
MD5: 693e3b2f0fb539d6513f31bbb75efb5d
Format: application/pdf
Last Update: April 25th, 2017
Size: 182.83 Kb
Fred Cohn (Schneider Electric), & Rupert Wimmer (Siemens)
vulnerability_statistics_v1.0.pdf
MD5: 6d082adf1bda626c28e06f1d311719de
Format: application/pdf
Last Update: April 25th, 2017
Size: 776.89 Kb
Antonio Villalon Huerta, S2 GRUPO CERT
While talking about APT attack mitigation techniques, we usually focus on technological aspects associated with intrusion and persistence phases, but ignoring some critical aspects, those on the reconnaissance phase, that could block (or at least, interfere) the attacker activities. In this sense, we must consider OPSEC as the process that allows us to identify our potentially useful information for the attacker, to know the threats and vulnerabilities it introduces and to define and implement appropiate countermeasures. (TLP:WHITE)

Antonio Villalon is S2 Grupo Chief Security Officer. Computer Engineer (Technical University of Valencia), Security Director (University of Valencia) and CISA (ISACA), he holds more than 20 years of experience in cybersecurity. He has executed and managed many analysis, attack, defence and exploitation projects, including the definition, start up and running of some SOC and CERT. He teaches and speaks about security in different universities and conferences on a regular basis, and has written some books and articles on the subject; his last book (in Spanish) is "Advanced Persistent Threats", published on December, 2016.
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 23, 2017 15:15-15:45
Hosted by Team S2 Grupo
villalon-huerta-antonio_slides.pdf
MD5: 7d6bfb47857134c4e62e823c31aaa6ad
Format: application/pdf
Last Update: February 1st, 2017
Size: 10.42 Mb
Erik Waher & Matt Moran (Facebook)
Incident Responders need reliable packet capture as a source of truth for what happened on their networks. You can’t file carve from netflow records that tarball the attackers exfiltrated from your breached server, and flow isn’t always detailed enough for writing an IDS signature. This leaves incident response teams with conjecture – “we know there was traffic, but we don’t know what it was.” Do you want to tell your legal team you know exactly what was lost in a breach, or #yolo “We think we only lost half the database”?
Historically, scaling packet capture infrastructure to meet network demands has been a significant challenge. Physical space for infrastructure can be limited, traffic rates can be too high to maintain meaningful retention windows, and costs may be prohibitive. How do you efficiently query petabytes of data in time to resolve an incident? “Capture All the Things!” seems impossible to scale in the real world.
To address these problems, our in-house security team built a scalable, cost-effective, pcap solution backed by Open Compute Project hardware. This presentation will walk you through the architecture and design decisions that enabled us build a high performance packet capture infrastructure capable of handling tens of Gbps per host and providing retention measured in petabytes. The solution automatically delivers packets to analysts and responders, allowing fast identification and reporting on security incidents.
MD5: a40991920260e47cb6fc650907b3d9a7
Format: application/pdf
Last Update: May 1st, 2017
Size: 804.86 Kb
Sunil Amin (Cisco Lancope)
This talk is introduction in the use of Network Flow telemetry (NetFlow, sFlow, IPFIX) for advanced analytics for security detection and incident investigation. We will start by covering some of the background and history of the protocols and the information they contain. Next, we will cover the techniques that can be used to pre-process the corpus and illustrate some of the analytic techniques that can be applied with real-world use cases and case studies. Finally, we will talk about the FOSS tool that are available to get you up and running as quickly as possible.
MD5: dba6e8da69e3d2ca4815f7e10ddf2ee2
Format: application/pdf
Last Update: May 9th, 2017
Size: 1.07 Mb
Matthias Seitz (SWITCH-CERT)
An update of the SWITCH DNS Firewall will be presented. This includes the current status, lessons learned and other important points. Also a overview what have changed on the RPZ market will be presented.
SWITCH_DNS_Firewall_Update.pdf
MD5: cf601c0076e7c23b609a0b61e51b5555
Format: application/pdf
Last Update: April 27th, 2017
Size: 2.4 Mb
Saad Kadhi, CERT-BDF
TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. It allows analysts to:
Further information can be found on the project’s website at: https://thehive-project.org
50th TF-CSIRT meeting and FIRST Regional Symposium
Valencia, ES
January 24, 2017 13:20-14:20
Hosted by Team S2 Grupo
MD5: a93a999e06895456681049b06b8e3ea1
Format: application/pdf
Last Update: February 1st, 2017
Size: 2.14 Mb
Gal Bitensky ( Minerva)
Malware often searches for specific artifacts as part of its “anti-VM\analysis\sandbox\debugging” evasion mechanisms, we will abuse its cleverness against it. The "anti-honeypot" approach is a method to repel (instead of luring) attackers, implemented by creating and modifying those artifacts on the potential victim’s machine. Once the created artifacts are found by the malware – it will terminate.
My session will include motivations for attackers to use evasion techniques, some in-the-wild examples and effective countermeasures against it. I also wish to perform a short DIY-vaccination demo, including the execution and prevention of a live malware. The script I will use in my demo to vaccinate the potential victim will be uploaded to GitHub and publicly shared.
MD5: d1377a47dd234e1156f403032e451af0
Format: application/pdf
Last Update: May 4th, 2017
Size: 16.44 Mb