Packet Hacking Virtual Village Workshops at DC 28 Safe Mode Ticket Sales

National Upcycled Computing Collective, Inc. is a 501(c)(3) non-profit organization (EIN 82-1177433) as determined by the Internal Revenue Service.Our Vision: To facilitate research into computer science, technology and engineeringNUCC, Inc. is further categorized as an NTEE U41 meaning it operates as a Computer Science, Technology and Engineering, Research Institute.The proponent of a proposal for any projects to exist at the National Upcycled Computing Collective, Inc., must satisfy the Board of Directors that the intended project will at a minimum:1. Support Research2. Promote Research3. Do ResearchWith the further understanding that the Project must perform research related to Computer Science with a specific focus on Technology and Engineering.

National Upcycled Computing Collective, Inc. (NUCC)

WELCOME TO THE PACKET HACKING VIRTUAL VILLAGE WORKSHOPS TICKET SALES REGISTRATION PAGE AT DC28 SAFE MODE!

100% of proceeds (less fees) benefit the National Upcycled Computing Collective, Inc. (NUCC), a 501(c)(3) non-profit organization.We've got some rules around here!1. *YOU MUST JOIN THE DEF CON DISCORD SERVER* : <a href="https://discord.gg/defcon" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://discord.gg/defcon</a>2. Your donation of $25.00 to NUCC reserves a conditional seat. If you are 1 second late, your seat will be given away (first come first serve) to those present. Please be there before the workshop start time!3. The ticket ONLY has value to the individual with the Eventbrite Registration Order Number. No transfers, no returns. (This means no scalping - we will abuse scalpers.)4. No Refunds! 0, None, Not at all!5. *MAXIMUM OF TWO WORKSHOPS PER PERSON*While Eventbrite may allow you to buy more than two workshops, you are only allowed to attend a maximum of two workshops. Feel free to buy 3, the third will be an extra donation to NUCC. You only get to go to two.Did we mention that you only get to go to two? Oh... And we will choose randomly which one(s) you lose out on in true DEF CON style.Important!Donations to NUCC above the base amount will be accepted at <a href="http://PayPal.me/NUCC" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">PayPal.me/NUCC</a> - This is a good cause. Don't be a cheap ass. Pony up some $.

All times are in PDT. Schedule is subject to change. More details, including registration and streaming links, forthcoming.<h3></h3><h3>WORKSHOPS ABSTRACTS AND BIOS</h3>INTRUSION ANALYSIS AND THREAT HUNTING WITH OPEN SOURCE TOOLSJOSH STROSCHEIN, DIRECTOR OF TRAINING, OPEN INFORMATION SECURITY FOUNDATION (OISF) / SURICATA; ASSISTED BY PETER MANEVAbstract: In today’s threat landscape, sophisticated adversaries have routinely demonstrated the ability to compromise enterprise networks and remain hidden for extended periods of time. In Intrusion Analysis and Threat Hunting with Open Source Tools, you will learn how to dig deep into network traffic to identify key evidence that a compromise has occurred, learn how to deal with new forms of attack, and develop the skills necessary to proactively search for evidence of new breaches. We will explore key phases of adversary tactics and techniques - from delivery mechanisms to post-infection traffic to get hands-on analysis experience. Open-source tools such as Suricata and Moloch will be utilized to generate data, perform exhaustive traffic analysis, and develop comprehensive threat hunting strategies. By the end of this workshop, you will have the knowledge and skills necessary to discover new threats in your network.Bios: Josh Stroschein is an experienced malware analyst and reverse engineer who has a passion for sharing his knowledge with others. He is the Director of Training for OISF, where he leads all training activities for the foundation and is also responsible for academic outreach and developing research initiatives. Josh is an accomplished trainer, providing training in the aforementioned subject areas at BlackHat, DerbyCon, Toorcon, Hack-In-The-Box, Suricon and other public and private venues. Josh is an Assistant Professor of Cyber Security at Dakota State University where he teaches malware analysis and reverse engineering, an author on Pluralsight, and a threat researcher for Bromium.Peter Manev has been involved with Suricata IDS/IPS/NSM from its very early days in 2009 as QA lead, currently a Suricata executive council member. Peter has 15 years experience in the IT industry, including enterprise and government level IT security practice. As an adamant admirer and explorer of innovative open source security software he is also one of the creators of SELKS - an open source threat detection security distro. He is also one of the founders of Stamus Networks, a company providing security solutions based on Suricata.VIOLENT PYTHON 3SAM BOWNE, INSTRUCTOR, CITY COLLEGE SAN FRANCISCO; ASSISTED BY ELIZABETH BIDDLECOME, PART-TIME INSTRUCTOR, CITY COLLEGE SAN FRANCISCO &amp; IRVIN LEMUS &amp; KAITLYN HANDLEMEN Abstract: Even if you have never programmed before, you can quickly and easily learn how to make custom hacking tools in Python. We build tools that perform port scanning, brute-force attacks, crack password hashes, and XOR encryption. Python is among the top three programming languages in the world, for good reason: it's the easiest language to use for general purposes.Bios: Sam Bowne (Twitter: <a href="https://twitter.com/sambowne" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">@sambowne</a>) has been teaching computer networking and security classes at City College San Francisco since 2000, and is the founder of Infosec Decoded, Inc. He has given talks and hands-on trainings at Black Hat USA, RSA, DEF CON, DEF CON China, HOPE, and many other conferences. Credentials: PhD, CISSP, DEF CON Black Badge Co-WinnerElizabeth Biddlecome is a consultant and instructor, delivering technical training and mentorship to students and professionals. She is a senior instructor for Infosec Decoded, Inc. She leverages her enthusiasm for architecture, security, and code to design and implement comprehensive information security solutions for business needs. Elizabeth enjoys wielding everything from soldering irons to scripting languages in cybersecurity competitions, hackathons, and CTFs.Irvin Lemus IT and Cyber Security can be challenging for anyone as well as Small and Medium Businesses. Since 2013, I have served clients throughout California, providing valuable professional services that bring peace of mind to clients as well as security against the constant threats with our ever-connected world. I look forward to working with you.Kaitlyn Handleman is a Professional Red TeamerWRITING WIRESHARK PLUGINS FOR SECURITY ANALYSISNISHANT SHARMA, R&D MANAGER, PENTESTER ACADEMY; ASSISTED BY JESWIN MATHAI, SECURITY RESEARCHER, PENTESTER ACADEMYAbstract: Network traffic always proves to be a gold mine when mined with proper tools. There are various open source and paid tools to analyze the traffic but most of them either have predefined functionality or scalability issues or one of a dozen other problems. And, in some cases when we are dealing with non-standard protocols, the analysis becomes more difficult. But, what if we can extend our favorite traffic analysis tool Wireshark to accommodate our requirements? As most people know, Wireshark supports custom plugins created in C and Lua which can be used to analyze or dissect the packets. In this workshop, we will learn the basics of Wireshark plugins and move on to create different types of plugins to perform dissection of non-standard protocol, provide macro statistics, detect attacks etc. We will use examples of older and newer protocols (including non-standard ones) to understand the plugin workflow and development.Bios: Nishant Sharma (Twitter: <a href="https://twitter.com/wifisecguy" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">@wifisecguy</a>) is an R&D Manager at Pentester Academy and Attack Defense. He is also the Architect at Hacker Arsenal where he leads the development of multiple gadgets for WiFi pentesting such as WiMonitor, WiNX and WiMini. He also handles technical content creation and moderation for Pentester Academy TV. He has 7+ years of experience in information security field including 5+ years in WiFi security research and development. He has presented/published his work at Blackhat USA/Asia, DEF CON China, Wireless Village, IoT village and Demo labs (DEFCON USA). Prior to joining Pentester Academy, he worked as a firmware developer at Mojo Networks where he contributed in developing new features for the enterprise-grade WiFi APs and maintaining the state of art WiFi Intrusion Prevention System (WIPS). He has a Master's degree in Information Security from IIIT Delhi. He has also published peer-reviewed academic research on HMAC security. His areas of interest include WiFi and IoT security, AD security, Forensics and Cryptography.Jeswin Mathai (Twitter: <a href="https://twitter.com/jeswinmathai" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">@jeswinmathai</a>) is a Researcher at Pentester Academy and Attack Defense. He has presented/published his work at DEF CON China, Blackhat Arsenal and Demo labs (DEFCON). He has a Bachelor's degree from IIIT Bhubaneswar. He was the team lead at InfoSec Society IIIT Bhubaneswar in association with CDAC and ISEA, which performed security auditing of government portals, conducted awareness workshops for government institutions. He was also the part of team Pied Piper who won Smart India Hackathon 2017, a national level competition organized by GoI. His area of interest includes Malware Analysis and Reverse Engineering, Cryptography, WiFi security and Web Application Security. WIRESHARK FOR INCIDENT RESPONSE &amp; THREAT HUNTINGMICHAEL WYLIE, DIRECTOR OF CYBERSECURITY SERVICES, RICHEY MAY TECHNOLOGY SOLUTIONAbstract: This workshop will take student’s Wireshark skills to the next level with a heavy emphasis on incident response, threat hunting, and malicious network traffic analysis. We will begin with a brief introduction to Wireshark and other Network Security Monitoring (NSM) tools/concepts. Placement, techniques, and collection of network traffic will be discussed in detail. Throughout the workshop, we’ll examine what different attacks and malware look like in Wireshark. Students will then have hands-on time in the lab to search for Indicators of Compromise (IOCs) and a potential breach to the network. There will be plenty of take-home labs for additional practice.Bio: Michael Wylie (Twitter: <a href="https://twitter.com/TheMikeWylie" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">@TheMikeWylie</a>), MBA, CISSP is the Director of Cybersecurity Services at Richey May Technology Solutions. In his role, Michael is responsible for delivering information assurance by means of vulnerability assessments, cloud security, penetration tests, risk management, and training. Michael has developed and taught numerous courses for the U.S. Department of Defense, DEFCON, Universities, and for clients around the world. Michael is the winner of numerous SANS challenge coins and holds the following credentials: CISSP, CCNA R&S, CCNA CyberOps, GMON, GPEN, TPN, CEH, CEI, VCP-DCV, CHPA, PenTest+, Security+, Project+, and more. ADVANCED APT HUNTING WITH SPLUNKMATT TOTH, SECURITY STRATEGIST – SPLUNK; ASSISTED BY ROBERT WAGNER, SECURITY STRATEGISTAbstract: You wanna learn how to hunt the APTs? This is the workshop for you. Using a real-worldish dataset, this workshop will teach you how to hunt the “fictional” APT group Taedonggang. We discuss the Diamond model, hypothesis building, LM Kill Chain, and Mitre ATT&CK framework and how these concepts can frame your hunting. Using Splunk and OSINT, we will hunt for APT activity riddling a small startup’s network. During the event, you will be presented a hypothesis and conduct your own hunts, whether it is for persistence, exfiltration, c2 or other adversary tactics. Heck, there might be some PowerShell to be found, too. We will regroup and review the specific hunt and discuss findings and what opportunities we have to operationalize these findings as well. At the end, we give you a dataset and tools to take home and try newly learned techniques yourself.Bios: Matthew Toth is a Security Strategist at Splunk with over 20 years of experience in the Information Technology industry, with a focus on Cyber Security. Working with the US Department of Defense, he has led teams in CyberWar simulations, and has advised senior leadership on new attack vectors and threat actors.Robert Wagner is a security professional with 20+ years of InfoSec experience. He is a co-founder of “Hak4Kidz.com”, an organizer with Burbsec and BurbSecCon in Chicago, and is on the Board of Directors of the ISSA Chicago Chapter.BAD ACTIVE DIRECTORY (BAD)DHRUV VERMA, SENIOR SECURITY CONSULTANT, NCC GROUP; ASSISTED BY MICHAEL ROBERTS: PRINCIPAL SECURITY CONSULTANT AT NCC GROUP &amp; KUAN XIANG WEN: SECURITY CONSULTANT AT NCC GROUPAbstract: This is an introductory to intermediate level Windows active directory (AD) training. The training has two parts: a lecture component, where we’ll cover how active directory works and the core things you need to know to attack it effectively, and a series of hands-on labs modeled after real attacks we’ve performed on client environments. The training will be heavily lab focused, with each student receiving their own AWS environment to play with. The labs are based off of how real modern networks look, not example test environments, and successfully completing each lab involves chaining together multiple vulnerabilities in a realistic kill chain methodology to get domain admin.Bios: Dhruv Verma is a Senior Security Consultant at NCC Group, an information security firm specializing in application, network, and mobile security. Dhruv has extensive experience performing infrastructure assessments with a special interest in Windows Active Directory environments and projects involving social engineering vectors. He has gotten domain admin on multiple client networks by chaining together vulnerabilities in a very unique and interesting fashion. For instance, Dhruv combined a misconfigured Jenkins server with a AWS IAM privilege escalation attack to gain Domain Admin on an enterprise network via a clone’n’pwn attack. Michael Roberts is a Principal Security Consultant with NCC Group. Michael performs web, mobile application and network penetration tests, and has a passion for virtual reality and cooking outside of work life. Michael holds a bachelor's degree in computer and information technology from Purdue University. Kuan Xiang Wen is a Security Consultant at NCC Group. Kuan has conducted some infrastructure assessments and first started BAD under the supervision of Dhruv and Michael as his intern project at NCC. Kuan is as exciting as Kashi cereal and likes to eat free food at hacker events.

<h3>LINKS</h3>DEF CON 28 - <a href="https://www.defcon.org/html/defcon-28/dc-28-index.html" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://www.defcon.org/html/defcon-28/dc-28-index.html</a>Wall of Sheep PHV - <a href="https://www.wallofsheep.com/pages/dc28" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://www.wallofsheep.com/pages/dc28</a>Aries Security - <a href="https://www.ariessecurity.com/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://www.ariessecurity.com</a>National Upcycled Computing Collective, Inc (NUCC) - <a href="http://nuccinc.org" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer"></a><a href="https://www.nuccinc.org" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">https://www.nuccinc.org</a>