Tickets For PHDays V Now Available

Ticket sales for the forum on practical information security Positive Hack Days V will start on Wednesday, December 23.

A two-day ticket bought until January 12 will cost 7,337 rubles. You can register and buy a ticket on the "Join the forum"' page.

How to Speak at PHDays V

Positive Hack Days V, the international forum on practical information security, opens Call for Papers on December 1. If you want to share your research results or have something to tell the community about, you are welcome to join PHDays speakers on May 26 and 27, 2015.

The forum has provided the stage for such speakers as Bruce Schneier (the legendary cryptography expert), Travis Goodspeed, Karsten Nohl, Marc "van Hauser" Heuse, Ruslan Gattarov, Datuk Mohd Noor Amin (IMPACT, UN).

Chief executives, CIO and CISO of the world's largest companies, information security experts, elite hackers, representatives of Skolkovo Foundation and governmental institutes are regular PHDays participants.

Positive Hack Days V: entering a singularity

The fifth Positive Hack Days international forum on practical information security will take place in World Trade Center Moscow on May 26 and 27, 2015. The conference organized by Positive Technologies will bring together leading experts on cyber defense and the elite of the hacker world, representatives of state institutions and executives of large businesses, young scientists and journalists.

Review of Competitive Intelligence Tasks

Today we'd like to speak about certain practical aspects of confidential data gathering in terms of tasks of the online contest Competitive Intelligence, which was held during May 15, 16 and 17.

Review of WAF Bypass Tasks

This year, the visitors of the Positive Hack Days Forum were invited to have a shot at bypassing the PT Application Firewall in the contest called WAF Bypass. It was a good opportunity for us to test our product in action, because the forum gathered the best information security experts. We had prepared a set of tasks for the contest, each representing a script with a typical vulnerability.

The participants were invited to use these vulnerabilities to get flags.  All tasks were solvable, though some solutions were not obvious. The contestants were provided with the report about scanning the tasks' source code with another Positive Technologies product Application Inspector. In this article, we will consider the contest tasks, bypassing methods, and the experience we have obtained.

Review of Hash Runner Tasks

Intro

This year, Hashrunner had been taking place during three days before Positive Hack Days — from May, 16 19:00 (UTC+4, Moscow) till May, 19 19:00 (UTC+4, Moscow). Among other matters, we were trying to respect the interests of all geographically dispersed teams and cover 48 hours of two weekend days for every time zone. We received great positive feedback about including the whole weekend and thus we’ll try to keep it this way.

Congratulations to the winners!

1. InsidePro with 22.81% (write-up) won two R290x video cards plus souvenirs.
2. hashcat with 21.23% (write-up) won an R290x video card plus souvenirs.
3. john-users with 12.78% (write-up) won souvenirs.

Within three years of the contest, we had three unique winners: hashcat in 2012, john-users in 2013, and InsidePro in 2014. Every year, most submissions were received in the last 15 minutes and thus the winner was determined in the very nick of time. In 2012 and 2013, InsidePro was beaten into the second place by hashcat and john-users, respectively. This year, InsidePro finally became the first.

Survive Hacking at PHDays. Cyber Threats of a Common Apartment

Items and devices we use are becoming more and more convenient. Today, we have internet connection in our cars and even in certain kinds of microwaves and fridges. According to Gartner, there will be more than 26 billion intelligent home appliances while the market size will grow to 300 billion dollars by 2020.

However, few people realize that common computers with access to the internet and gadgets that make up the so-called internet of things are vulnerable to attacks. PHDays organizers created a model of a real apartment equipped with various electrical appliances and a smart home system in order to demonstrate the possible consequences of hackers' attacks. Due to an error, all devices of the apartment has gone insane and turned out to be a trial for the owner. Participants of the contest needed to release him.

PHDays IV CTF: How It Was

Positive Hack Days IV, which was held on May 21 and 22, traditionally hosted a CTF contest. During two days, ten teams from six countries hacked rivals' networks and beat back attacks.

Positive Hack Days CTF's game infrastructure and tasks are usually designed according to a legend that adds special appeal to the contest. During the last year's CTF, participants became the saviors of the fictional world D’Errorim. As the task was solved, they realized that they were fighting on the wrong side, and now their own home is in danger. So the plotline of PHDays III CTF and PHDays IV CTF are related.

The text of the legend is available on the forum's website.

Smart City Hacked at PHDays IV

The Critical Infrastructure Attack (CIA) contest at Positive Hack Days IV has shown for the second time how weak critical infrastructure systems can be in terms of security. The participants successfully compromised various ICS systems during this two-day contest.

Last year at PHDays III, the contest was held with different name – Choo Choo Pwn. Organizers designed a transportation system controlled by real ICS hardware and software.

Positive Hack Days IV: There are Doors that should be Opened Carefully

The famous quote of Friedrich Nietzsche about an abyss that gazes into you became the motto of the PHDays IV forum on practical security. Participants of the annual international conference learned about cyber threats for which the civilization is unprepared: attacks performed against power and transport systems of a city, a smart home turned into a trap, and hackers emptying a virtual bank account. Various ways of survival in today's digital world were also discussed during the forum.

The recipe for PHDays is the same: minimum ads, maximum useful information, entertaining contests, informal communication, rich performances, awkward questions at round-table discussions, and an atmosphere of a research during hands-on labs.

Best Reports at PHDays IV: Surveillance, Hacking and Nation-Specific Cyberwar

Big conferences with multiple reports delivered at once seem to cooperate with the Murphy's Law — the most interesting (personally to you) sections have the same schedule time. Choose one of them — miss the others. What can you do?

As to the international forum on practical security Positive Hack Days, this problem is easy to solve — watch the report video records. It is particularly valuable for those who missed the conference. All the video files are on the website phdays.com/broadcast/.

Yet watching all the records made in all the halls during two days is an option for extremely patient people. It is far more logical to filter them by topics or authors: first, read the descriptions in the program and then choose a particular report from the video list.

The $natch Contest Is Over

The $natch contest took place during Positive Hack Days IV. Contestants needed to detect vulnerabilities in remote banking systems.

The contest was held in two stages. At first, the participants were provided with copies of virtual machines containing vulnerable web services of an online banking system (an analogue of an actual Internet banking system). The participants should detect vulnerabilities in the system within a specified period of time. In the second stage the participants were to exploit the vulnerabilities for unauthorized money withdrawal.

Any Participant Can Speak at PHDays

For the first time at Positive Hack Days an open-mic session will be held. Any participant will be able to share details about his or her work and research with world’s leading experts.

$natch at PHDays — E-banking System to Be Hacked is Available for Download

Do you want to try what it’s like to be a hacker stealing money from bank accounts? Take part in the $natch contest at Positive Hack Days IV!

You will test your knowledge and skills in exploiting common vulnerabilities of remote banking web services. The task is based on the vulnerabilities that Positive Technologies' experts commonly find during real-life remote banking pentests.

Critical Infrastructure Attack. How to Hack a Whole City

We've heard a lot about industrial control systems that help reduce traffic congestions, save electricity and water, make production processes more efficient.... But what if just one hacker disrupts the whole infrastructure of a city? You think it's just a creepy idea for a sci-fi film? Let's check it!

During the Critical Infrastructure Attack contest participants will be able to analyze the security of ICSs that are commonly used for factories and water power plants, transport infrastructure, illumination systems, oil and gas industry. To win, a participant should detect vulnerabilities and demonstrate their exploitation on the contest city model.

Government and Business Resistance to New Cyberthreats: The PHDays IV Business Program

The security of critical infrastructures, prospects for investment in information security, the expediency of increasing control over the Internet, recent trends of the area of telecommunications, the security of web applications and remote banking systems, new products of the IS market—these are the main topics of the Positive Hack Days IV forum that will be held on May 21 and 22 this year.

PHDays is an unprecedentedly large event that brings together specialists from both sides of the barricade, theory and practice, professional discussion and fascinating competitions. More than 2,000 specialists from 700 organizations in 18 countries will participate in the forum. The organizer is Positive Technologies.

The largest technological companies will join PHDays as partners of the event: Cisco, EMC, ICL-КME CS, Intel Security, Kaspersky Lab and Mail.Ru are among them. The forum is organized with the informational support of 27 leading business and specialized media companies. Main media partners are the Expert magazine, BFM.ru (a business information portal), the Hacker magazine, the Internet portals SecurityLab.ru and Anti-Malware.ru, and the Bankir.Ru news agency.

PHDays Cyberpunk Devourers Night

Many occupations are described in literature and cinemas. There are songs about pilots and scientists, films about sailors and doctors, novels about killers and bankers. However, millions of coders and other computer specialists get undeservedly little attention in the mass culture. You will hardly find a really worthwhile book or film about hackers.

But that’s unfair! Just think about admins —no company can do without them. People run computer programs on their smartphones even more often than they talk to their family members. Where in the world are inspiring stories about people who create and hack digital universes?

Hackspaces from Four Different Countries Join PHDays Everywhere

Specialists in information security, scientists, politicians and businessmen will soon meet up in Moscow at the international forum Positive Hack Days. And this year, for the third time straight, people from other counties will be able to join the forum thanks to the PHDays Everywhere program (find more about last year's activities in the forum's blog).

On May 21 and 22, hackspaces of different countries will open their doors to all comers. Hackspaces from Abu Dhabi (UAE), Birzeit (Palestine), Kiev and Lviv (Ukraine), and from such Russian cities as Krasnodar, Moscow, Murmansk, Novosibirsk, Omsk, Samara, Saratov, Ufa, Vladivostok, Vologda have already joined the initiative.

Competitive Intelligence Contest at PHDays III Writeup

Many things changed since the contest Competitive Intelligence was held last time. Snowden exposed NSA, it turned out that not only gossip-hungry housewives interfere in people’s lives on the Internet, but also serious specialists with the help of MIT mathematicians. The security of both proprietary and open-source protocol implementations proved to be far lower than expected. Algorithms for processing big data in cloud solutions nowadays allow tracking correlations of bitcoin transactions, which previously were considered safe and anonymous….

Three winners — those, who solves the task quicker than others, will receive free tickets to PHDays IV, where they will be generously awarded. The prize for being the first is iPad. The contest will be held one week before the forum and will last for two days — May 15 and 16.

You are welcome to register at http://www.phdays.com/registration/.

If you have any questions email them to ci@ptsecurity.com.

This year's contest sponsor is Zecurion.

Writeup Cometitive Intelligence PHDays III

The main idea for the "Competitive Intelligence" competition was to employ real-world methods for data collection and analysis, penetration testing, search mechanisms and deductive reasoning as well as to access audience’s awareness level of information security.

Unlike in 2012, since the tasks proved more difficult, this year no one managed to solve all of the challenges. Winners collected 12 correct answers and were ranked based on how much time they spent completing the activities.

Now, let’s estimate the results, provide correct answers for those that failed and review the amended list of winners.

The company to work with was Godzilla Nursery Laboratory - as international company breeding and selling companion godzillas. Godzillas were chosen deliberately as they "guarded" a railway in the Choo Choo Pwn competition.

Google directly hints that the official site of this company with a nice logo is www.godzillanurserylab.com, and most employees have LinkedIn profiles. Well, come on!

PHDays CTF Quals: Tasks Analysis

Positive Hack Days CTF is an international information protection contest based on the CTF (capture the flag) principles. Several teams are to defend their own networks and attack the networks of the other teams for a specified period of time. The contestants need to detect vulnerabilities in other teams' systems and to obtain sensitive information (flags) while detecting and fixing vulnerabilities of their own systems.

Today we would like to analyze certain interesting tasks that were offered to participants of the past contests.

History and Geography

This year PHDays CTF takes place for the fourth time. The contest was launched during the Positive Hack Days forum in 2011. Back then, the team PPP from the US was the winner. The following year in 2012 Leet More from Russia took first place. In 2013 at PHDays III, Eindbazen from the Netherlands took the top prize. Teams from all over the world — from the USA to Japan — participate in PHDays CTF every year.

More than 600 teams from all over the world have registered to take part in this year’s PHDays CTF.

Tasks and the Atmosphere

Traditionally, tasks and infrastructure are prepared based on a legend of the contest, which would turn a set of tasks into a fascinating competition. Last year, PHDays CTF participants tried to save the fictional world D’Errorim. The upcoming contest will continue the plot.

Experts and Hackers to Land on the PHDays Field How to fabricate a key, crack a browser, escape from a smart home

Why the Internet of things is a threat to national security? What is impressioning? How to detect a zero-day vulnerability in applications presented in the quantity of hundreds of millions of copies? Is there a panacea for DDoS attacks? We would like to bring to you attention a new set of reports that will be presented at Positive Hack Days IV.

Two thousand experts in practical security will gather in Moscow on May 21 and 22 this year to discuss Iranian, Chinese and North Korean cyberpotencial, cryptography after Snowden and Heartbleed, raising information security awareness of Yandex specialists, important discoveries of SCADA Strangelove, cyberthreat for modern electrical substations, main attack vectors against SAP systems. Attendees of the forum will hear about new generation indicators of compromise, visual analytics in the field of information security, automated reverse engineering and more.

The PHDays IV programm includes more than 40 reports, sections and round tables, hands-on labs, short and informative Fast Tracks.

Young School Finalists Defined

The Young School competition is being held for the third time in a row. The goal of the contest is to support young and talented specialists in information security giving them the opportunity to present their reports at the Positive Hack Days forum. A range of topics is rather wide, from applied cryptography through to ICS and government information systems security. The competition is designed for students, postgraduates, and young scientists.

PHDays IV Competitive Program

There is little time left before the beginning of PHDays. The CTF finalists are already determined, we develop the conference program (see part 1 and 2) and prepare PHDaуs Everywhere activities. Surely, not only exciting talks and hands-on labs, but also awesome contests are waiting for the visitors!

A Surprise Performance at PHDays

Since the topics to be discussed at Positive Hack Days IV are far beyond just technical issues, there's a surprise in store for participants of the forum. The creators of the project Model Dlya Sborki (or MDS, lit. “a model kit”) will present live audio performance at the Digital October Center on May 21 (from 7 pm till 10:30 pm).

Hacking Contests at PHDays Everywhere

This year Positive Hack Days is held for the fourth time. As usual, not only those who will visit Moscow on May 21 and 22, but also the participants (and organizers!) of PHDays Everywhere from all over the world will be able to join the forum via their hackspaces!

PHDays Everywhere as well as CTF and the 2drunk2hack contest have easily blended in the forum. This year information security specialists will come together again in different cities and countries to watch PHDays live in the HD format, mix with each other and participate in various competitions.

Previously, PHDays Everywhere provided fascinating contests for hackspace attendees in addition to online competitions held among all Internet users, and this tradition will continue this year as well.

How to Hack Gmail and WordPress and Spy through TV

Hacking emails of authoritative users is usually accompanied by debates about the identity of such email correspondence that became available on the Internet. Until now, we thought that a correct DKIM signature indicates at the author of the correspondence containing this signature. But can we trust this authentication mechanism? Vulnerabilities in Google, Yandex and Mail.Ru will be discussed at the international information security forum Positive Hack Days IV, which will be held on May 21 and 22 in Moscow.

Discount PHDays IV Tickets are Available till March 16

We have great news! You can get tickets to the PHDays IV forum at the Early Birds discount until March 16, 2014.

The special prices are 9,770 rubles per two days and 7,470 rubles per day. After March 17, the price for a ticket will increase up to 13,870 rubles per two days and 9,770 rubles per day.

PHDays IV Topics

How can you create a virus or a botnet for Android? What else do you get when you buy a hard disk drive at an eBay auction? What threats surround a SIM card owner? How can you get one-time password tokens?

Get answers to these questions and more at Positive Hack Days IV, the international information security event.

The final stage of Call For Papers started on February 17 and lasts until March 31. The first group of speakers for the technical program of PHDays IV has been selected. Abstracts of their papers are presented below.

Only Two Weeks Left to Apply for PHDays Young School

Do to  popular demand we have decided to extend the application deadline for the information security competition of young scientists. Applications for  participation in PHDays IV Young School will now be accepted until March 1, 2014 (23:59 UTC).

This the third year for Young School, but the first time, scientists from outside Russia are invited to participate – making it truly an international contest. The competition is designed for students, postgraduates, and young scientists who conducted studies based on various topics.

Hackers from All Over the World Fought to Partake in PHDays IV CTF

PHDays CTF Quals, an information security competition, took place from 12 p.m. on January 25 to 12 p.m. on January 27 and lasted for the whole 48 hours. Dragon Sector, a Polish team, won the contest, though quite unexpectedly. PPP from US took second place and More Smoked Leet Chicken (Russia) came third again.

The main feature of this Quals (as compared to the previous years' competitions) was a special quest game. Participants should solve it in order to earn points, which could be used to open CTF tasks and then gain final points. The plot of the quest was based on the legend, which was the part of PHDays III CTF. This time teams needed to work shoulder to shoulder with the Golem special division and investigate an incident related to the spreading of the Detcelfer worm.

PHDays CTF Quals Rules

There is not much time left until PHDays IV CTF Quals, and it's time to reveal the rules and game mechanics.

First of all, the new mechanics are all meant to bring some additional fun to CTF. The game is balanced in such a way that you receive most of the points (more than 90%) for solving the tasks. So you still have to be the best hackers to make it to the top.