Midnight Sun 2024

In today's ever-evolving threat landscape, ransomware attacks have become increasingly intricate. To effectively prevent these malicious incidents, it is imperative to grasp their origins, evolving tactics, and emerging trends. This presentation will delve into the depths of the ransomware market, explore what is changing, evaluate potential impacts, and provide proactive strategies for staying ahead of these attacks. Key topics include:

• Unveiling the current state of ransomware markets and recent ransomware trends
• Strategies and methodologies to prevent ransomware
• Real-world insights: how to use threat intelligence to mitigate ransomware risks to your organization

In this talk we will justify building an system emulator from scratch to fuzz hard-to-reach areas of the linux kernel. We will discuss design choices and tricky implementation details.

The Russia-Ukraine War has significantly impacted Russia's cyber ecosystem and the strategy, policy, and operations affecting and carried out by a web of criminal hackers, military and intelligence officers, and private-sector cybersecurity firms and state contractors. These cyber activities and evolutions impact Russian citizens, the Russian state's ability to launch offensive operations against Western powers, and the future of Moscow's technology ecosystem. Justin Sherman will present new findings from Margin Research's data and OSINT analysis of Russian cyber power during the Russia-Ukraine War and specific Russian cyber actors supporting the Kremlin.

With the upcoming shift from 5G to 6G networks, trustworthiness will be an important cornerstone delivering trusted communication and computing for industry and society relying on critical information. This transition from secure communication to trustworthy platforms—expanding the scope from protecting data to ensuring the end-to-end service delivery in a wide range of relevant scenarios - will pave the way for wireless networks increasingly becoming critical components of society. Resilience and security capabilities are crucial as networks must be able to provide service when part of the infrastructure is disabled due to natural disasters, local disturbances, or societal breakdowns, and they must offer robust resistance against deliberate malicious attacks. 6G networks will be able to leverage new confidential computing technologies, improve service availability, and provide enhanced security identities and protocols with end-to-end assurance.

To enhance national security measures, we aim to systematically assess the cyber threat landscape facing our country, Sweden. Our approach entails the comprehensive collection and automated processing of intelligence data to map vulnerabilities within our national infrastructure visible from the internet. Subsequently, we endeavor to predict the likelihood of these systems being compromised by malicious actors and to identify any attacker infrastructures operating within our borders. Initially utilizing open-source intelligence (OSINT) tools for preliminary analyses, we will evaluate their efficacy in bolstering national-scale efforts and determine the most suitable solutions for our needs. This research aims to provide actionable insights and proactive measures to safeguard Sweden's cyber resilience against evolving threats.

VPN systems should help protect your communication from network attackers. However, in this talk we will show how we decrypted NordVPN client applications' communication. Not only to intercept your VPN traffic, but also to get access to other devices in your private network.

As we send increasingly sensitive data over untrusted networks, our communication is constantly under attack. Especially while communicating from foreign or hostile jurisdictions, network interception attacks are more a rule than an exception.

Even while browsers and applications try their best to encrypt their communication, they leak metadata and are susceptible to n-day or 0-day vulnerabilities. Encrypting all the communication with a VPN can help mitigate these risks.

Numerous consumer grade VPN providers have been popping up over the years with promises of ease of use while providing military grade protection.

In this talk, we will show how NordVPN failed to deliver on this promise. While being easy to use, it unfortunately was also easy to hack. We will decrypt NordVPNs communication through a network interception attack and hack into other devices in your private network.

I will lament recent frustrations with decompiling APKs:

• decompilers that crash
• decompilers that hide control flow information

And propose that we search for simpler and more robust solutions that still get the job done. I will share my experience with building a Dalvik disassembler and building a graphview on top of it

In this brief talk we'll discuss macOS user privacy protections and a logic bug in the PackageKit framework which leads to a complete SIP/TCC bypass ( CVE-2023-38609 ) on macOS Ventura. The talk will cover initial discovery, automating variant discovery and chaining with a patched privilege escalation to achieve unrestricted access from a regular user context.

This lightning talk will discuss the opportunities and limitations of integrating program runtime information with large language models (LLM) and how this relates more generally to LLMl reasoning capabilities. Additionally, we will explore a new method that combines LLMs with reinforcement learning to pragmatically and efficiently fine-tune models with the most salient runtime information relative to the programmer's existing beliefs of the code they are seeking to understand or generate. Attendees will leave with the ability to - in a matter of hours - add runtime information (both in the form of fine-tuning and prompt engineering) to their hosted models for code generation or analysis.

As the open source software (OSS) landscape continues to expand, it becomes a larger playground for cyber adversaries, posing a remarkable challenge for maintaining national cybersecurity. In this enlightening and (hopefully) occasionally humorous talk, we delve into Reagent, Margin Research's trailblazing open source analysis platform, and how it leverages socio-technical analytics to unveil suspicious activities within OSS projects.

Reagent represents a significant evolution in analyzing the complex social dynamics of software development. By integrating graph databases with specialized algorithms with Python heuristics, Reagent transforms how organizations detect and avert threats lurking within vast volumes of OSS contributions. Illustrating its cutting-edge functionalities, we share captivating case studies, such as the infamous "XZ Hack", revealing how Reagent pinpointed bad actors amidst tens of thousands of contributors through adversarial correlation techniques, natural language processing, and anomaly detection.

Guided by an automated approach that analyzes cross-repository metadata using the latest and greatest algorithmic technologies, Reagent not only detects low-profile, yet high-risk users, identifies how palatable a threat is to adversaries, and discovers one-off commits made by aliased git users, but also shines the spotlight on suspicious code contributions and maintainers. From in-depth timezone analysis, to drive-by commit discovery, to sentiment analysis in messages to high-level maintainers, we prove that having the right toolbox can expose even the most sophisticated false users behind supply chain intrusions.

Through the lens of technical storytelling, you'll see not just the software's prowess, but also how the human touch remains indispensable to bad actor discovery. Reagent's versatile queries unearth potential concerns within email domains, timezone spoofing, and coding behavior purity, allowing the integration of humor, such as the bewildering choices of developers to commit code in the future and maintain widely used packages under the moniker "meow", without losing its grip on critical analytics. Additionally, we aim to highlight the ongoing research in vulnerability and bad actor discovery within the open source community by showing that we're continually modifying our approach in response to new threats, as we either discover them in our database, or read about them on the news.

In our concluding reflections, the talk emphasizes the vital role of platforms like Reagent in safeguarding OSS integrity. With real-world applications and a dash of wit, we affirm that combating cyber threats in the digital age requires not just powerful algorithms, but creative and strategic thinking.