Webinar Sobre Docker, Kubernetes y SecDevOps

• April 11, 2019
• tuxotron

*HCDS – Docker & SecDevOps* Basado en el libro de Docker: SecDevOps, Fran Ramírez, Alberto Berdugo y un servidor, hemos tenido la oportunidad de grabar un webinar en colaboración con The Security Sentinel. En dicho webinar, prácticamente hemos cubierto todo el contenido del libro, pero en vez de la introducción a Docker Swarm, la hemos sustituido con una amplia introducción a Kubernetes y hemos ampliado la parte de SecDevOps. Además cada apartado teórico está repleto de ejemplos para que el alumno pueda poner en práctica lo aprendido.
Leer más

Vídeos de Black Hat USA 2018

• November 18, 2018
• tuxotron

*Black Hat USA 2018* Ya están disponibles los vídeos de Black Hat 2018: Black Hat USA 2018 Keynote: Parisa Tabriz [How can Communities Move Forward After Incidents of Sexual Harassment or Assault?](https://www.youtube.com/watch?v=vH28IUgJCH8&index=3&t=0s& list=PLH15HpR5qRsVAXGmSVfjWrGtGLJjIJuGe) [Unpacking the Packed Unpacker: Reverse Engineering an Android Anti-Analysis Native Library](https://www.youtube.com/watch?v=s0Tqi7fuOSU&inde x=4&t=0s&list=PLH15HpR5qRsVAXGmSVfjWrGtGLJjIJuGe) [Fire & Ice: Making and Breaking macOS Firewalls](https://www.youtube.com/watch?v=_xsnedUp4ko&index=5&t=0s&list=PLH15HpR5qRsVAXGmSVfjWrGtGLJj IJuGe) [Practical Web Cache Poisoning: Redefining ‘Unexploitable’](https://www.youtube.com/watch?v=j2RrmNxJZ5c&index=6&t=0s&list=PLH15HpR5qRsVAXGmSV fjWrGtGLJjIJuGe) [An Attacker Looks at Docker: Approaching Multi-Container Applications](https://www.youtube.com/watch?v=HTM3ZrSvp6c&index=7&t=0s&list=PLH15Hp R5qRsVAXGmSVfjWrGtGLJjIJuGe) [SirenJack: Cracking a ‘Secure’ Emergency Warning Siren System](https://www.
Leer más

Vídeos DEF CON 26

• October 25, 2018
• tuxotron

*DEF CON 26* Aquí os dejo los vídeos que se han publicado de DEF CON 26). Ya tenéis entretenimiento para el fin de semana que se avecina. Recuerda que también tienes el material disponible. Rob Joyce - NSA Talks Cybersecurity Eyal Itkin, Yaniv Balmas - What the Fax?! Josh Mitchell - Ridealong Adventures: Critical Issues with Police Body Cameras Svea, Suggy, Till - Inside the Fake Science Factory Ladar Levison, hon1nbo - Booby Trapping Boxes 0x200b - Detecting Blue Team Research Through Targeted Ads [Si, Agent X - Wagging the Tail:Covert Passive Surveillance](https://www.
Leer más

Vídeos De Usenix 17

• September 19, 2017
• tuxotron

*USENIX 17* Además del material de USENIX 17, ya están disponibles también los vídeos de las charlas. Aquí tenéis la lista completa: Opening Remarks and Awards When Your Threat Model Is “Everything”: Defensive Security in Modern Newsrooms How Double-Fetch Situations turn into Double-Fetch Vulnerabilities… Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts Ninja: Towards Transparent Tracing and Debugging on ARM Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX On the effectiveness of mitigations against floating-point timing channels Constant-Time Callees with Variable-Time Callers Neural Nets Can Learn Function Type Signatures From Binaries CAn’t Touch This… Efficient Protection of Path-Sensitive Control Security Digtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels Venerable Variadic Vulnerabilities Vanquished Towards Practical Tools for Side Channel Aware Software Engineering… Strong and Efficient Cache Side-Channel Protection… CacheD: Identifying Cache-Based Timing Channels in Production Software An Ant in a World of Grasshoppers From Problems to Patterns to Practice… BinSim: Trace-based Semantic Binary Diffing… PlatPal: Detecting Malicious Documents with Platform Diversity Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART Global Measurement of DNS Manipulation Characterizing the Nature and Dynamics of Tor Exit Blocking DeTor: Provably Avoiding Geographic Regions in Tor SmartAuth: User-Centered Authorization for the Internet of Things AWare: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices Identifier Binding Attacks and Defenses in Software-Defined Networks HELP: Helper-Enabled In-Band Device Pairing… Attacking the Brain: Races in the SDN Control Plane Detecting Credential Spearphishing in Enterprise Settings SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data When the Weakest Link is Strong… Hacking in Darkness: Return-oriented Programming against Secure Enclaves vTZ: Virtualizing ARM TrustZone Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing AuthentiCall: Efficient Identity and Content Authentication for Phone Calls Picking Up My Tab… TrustBase: An Architecture to Repair and Strengthen… Transcend: Detecting Concept Drift in Malware Classification Models Syntia: Synthesizing the Semantics of Obfuscated Code Predicting the Resilience of Obfuscated Code… Differential Privacy: From Theory to Deployment OSS-Fuzz - Google’s continuous fuzzing service for open source software Extension Breakdown… CCSP: Controlled Relaxation of Content Security Policies… Same-Origin Policy: Evaluation in Modern Browsers Locally Differentially Private Protocols for Frequency Estimation BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model Computer Security, Privacy, and DNA Sequencing… BootStomp: On the Security of Bootloaders in Mobile Devices Seeing Through The Same Lens… Oscar: A Practical Page-Permissions-Based Scheme… PDF Mirage: Content Masking Attack Against Information-Based Online Services Loophole: Timing Attacks on Shared Event Loops in Chrome Game of Registrars… Speeding up detection of SHA-1 collision attacks… Phoenix: Rebirth of a Cryptographic Password-Hardening Service Vale: Verifying High-Performance Cryptographic Assembly Code Exploring User Perceptions of Discrimination in Online Targeted Advertising Measuring the Insecurity of Mobile Deep Links of Android How the Web Tangled Itself Towards Efficient Heap Overflow Discovery DR.
Leer más

Vídeos de Usenix Enigma 2017

• March 9, 2017
• tuxotron

Aquí tenéis los charlas (vídeos y algunas diapositivas) de la edición de este año de la conferencia Usenix Enigma: Human Computation with an Application to Passwords Moving Account Recovery beyond Email and the "Secret" Question Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud Inside "MOAR TLS:" How We Think about Encouraging External HTTPS Adoption on the Web Ghost in the Machine: Challenges in Embedded Binary Security LLC Cache Attacks: Applicability and Countermeasures IoT, a Cybercriminal's Paradise Hacking Sensors Test Driven Security in Continuous Integration As We May Code Leveraging the Power of Automated Reasoning in Security Analysis of Web Applications and Beyond Startups + Industry: How Everyone Can Win Behaviors and Patterns of Bulletproof and Anonymous Hosting Providers StreamAlert: A Serverless, Real-time Intrusion Detection Engine Neural and Behavioral Insights on Trust What Does the Brain Tell Us about Usable Security?
Leer más

Vídeos de RSA USA 2017

• February 18, 2017
• tuxotron

Si no tienes nada que hacer este fin de semana, aquí tienes lo vídeos de la conferencia RSA USA 2017. Hello False Flags! The Art of Deception in Targeted Attack Attribution The Blockchain Identity Crisis From Boot-to-Root: A Method for Successful Security Training CISO as Change Agent: Getting to Yes Deconstructing Identity Analytics for Higher Risk Awareness IoT: End of Shorter Days Workplace Violence and IT Sabotage: Two Sides of the Same Coin?
Leer más

Inside Russia’s Hacker Underworld (Bloomberg)

• February 12, 2017
• cybercaronte

Leer más

Vídeos de ekoparty 12 - 2016

• January 20, 2017
• tuxotron

Si no tienes nada planeado para este fin de semana, aquí tienes algo de distracción, los vídeos de las charlas de la pasada conferencia sobre seguridad informática celebrada en Buenos Aires, Argentina, Ekoparty 12. Tyler Curtis - Encryption out of LINE Juan Berner - Exploiting A/B Testing for Fun and Profit Nahuel Cayetano Riva - Getting fun with Frida Rodrigo Cetera y Javier Bassi - #KillTheHashes - El Gran Libro para Colorear Malware Ezequiel Fernandez y Sergio Viera - Multiple Vulnerabilities in SE PLC Joernchen - Let Me GitHub That For You (2016 Argentinian Edition) Martin Gendler - Juegos Online, Sociedad y Privacidad: un recorrido socio-histórico Sheila Berta y Claudio Caracciolo - Backdooring CAN Bus for Remote Car Hacking Nahuel Sánchez y Sergio Abraham - SAP HANA under the hood Enrique Nissim - I Know Where Your Page Lives: De-randomizing the Windows 10 Kernel Sebastian Garcia - Stratosphere IPS.
Leer más

Vídeos del Chaos Communication Congress (33c3)

• December 28, 2016
• tuxotron

Aunque el congreso sobre hacking/seguridad, Chaos Communication Congress todavía no ha terminado, los vídeos de las charlas que ya se han dado están disponibles. En los momentos de escribir estas líneas, estos son los vídeos disponibles: 33C3 Closing Ceremony Security Nightmares 0x11 Surveilling the surveillers 33C3 Infrastructure Review Virtual Secure Boot The Ultimate Game Boy Talk Privatisierung der Rechtsdurchsetzung Warum in die Ferne schweifen, wenn das Ausland liegt so nah?
Leer más

Vídeos de App Sec USA 2016

• November 15, 2016
• tuxotron

Ya están disponibles los vídeos de las presentaciones de App Sec USA 2016 Cleaning Your Applications' Dirty Laundry with Scumblr - AppSecUSA 2016 Everything is Terrible: Three Perspectives on Building, Configuring, and Securing Software HTTPS & TLS in 2016: Security practices from the front lines - AppSecUSA 2016 Justin Collins - Practical Static Analysis for Continuous Application Security - AppSecUSA 2016 Using language-theoretics and runtime visibility to align AppSec with DevOps - AppSecUSA 2016 Manideep Konakandla - Breaking and Fixing your ‘Docker’ ized environments - AppSecUSA 2016 Chris Gates & Ken Johnson - DevOops: Redux - AppSecUSA 2016 Zane Lackey - Practical tips for web application security in the age of agile and DevOps Chenxi Wang - Protect Containerized Applications With System Call Profiling - AppSecUSA 2016 Scaling Security Assessment at the Speed of DevOps - AppSecUSA 2016 Yair Amit - The Ways Hackers Are Taking To Win The Mobile Malware Battle - AppSecUSA 2016 Your License for Bug Hunting Season - AppSecUSA 2016 When encryption is not enough: Attacking Wearable - AppSecUSA 2016 Jimmy Mesta - Containerizing your Security Operations Center - AppSecUSA 2016 Practical Tips For Running A Successful Bug Bounty Program - AppSecUSA 2016 Simon Thorpe - Why using SMS in the authentication chain is risky - AppSecUSA 2016 Marco Lancini - Needle: Finding Issues within iOS Applications - AppSecUSA 2016 Patterns of Authentication and Self-Announcement in IoT - AppSecUSA 2016 [AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
Leer más