{"days":[{"id":6,"name":"Wednesday \u2013 Conference Day 2 - SAS Unplugged","date":"2020-04-08 00:00:00","room":null,"show_date":"Wednesday, April 8","sessions":[{"id":2,"name":"SESSION 11:","leading":null,"order":4,"day_id":6,"lectures":[{"id":3,"session_id":2,"time_start":"2020-04-08 10:00:00","time_end":"2020-04-08 10:30:00","title":"Documents of Doom Infecting MacOS via Office Macros","lector":"Patrick Wardle","company":"Objective-See","time_start_gi":"10:00","time_finish_gi":"10:30","tags":[]},{"id":4,"session_id":2,"time_start":"2020-04-08 10:30:00","time_end":"2020-04-08 10:50:00","title":"TBA","lector":"TBA","company":"","time_start_gi":"10:30","time_finish_gi":"10:50","tags":[]},{"id":5,"session_id":2,"time_start":"2020-04-08 10:50:00","time_end":"2020-04-08 11:10:00","title":"TBA","lector":"TBA","company":"","time_start_gi":"10:50","time_finish_gi":"11:10","tags":[]},{"id":6,"session_id":2,"time_start":"2020-04-08 11:10:00","time_end":"2020-04-08 11:30:00","title":"Expose Yourself Without Insecurity: Finding Patterns in the Cloud","lector":"Rob Ragan, Oscar Salazar","company":"Bishop Fox","time_start_gi":"11:10","time_finish_gi":"11:30","tags":[]},{"id":7,"session_id":2,"time_start":"2020-04-08 11:30:00","time_end":"2020-04-08 12:00:00","title":"Coffee break","lector":"","company":"","time_start_gi":"11:30","time_finish_gi":"12:00","tags":[]},{"id":2,"session_id":2,"time_start":"2029-04-08 08:00:00","time_end":"2029-04-08 10:00:00","title":"Breakfast & registration","lector":"","company":"","time_start_gi":"8:00","time_finish_gi":"10:00","tags":[]}]},{"id":3,"name":"SESSION 12:","leading":null,"order":9,"day_id":6,"lectures":[{"id":14,"session_id":3,"time_start":"2020-04-08 12:00:00","time_end":"2020-04-08 12:30:00","title":"Tracking and Attribution of Funding of Neo-Nazi Domestic Terrorist Groups","lector":"John Bambenek","company":"Bambenek Consulting","time_start_gi":"12:00","time_finish_gi":"12:30","tags":[]},{"id":15,"session_id":3,"time_start":"2020-04-08 12:30:00","time_end":"2020-04-08 12:50:00","title":"Misinfosec - Tooling up for Cognitive Security","lector":"Sara-Jane Terp","company":"Bodacea Light Industries","time_start_gi":"12:30","time_finish_gi":"12:50","tags":[]},{"id":16,"session_id":3,"time_start":"2020-04-08 12:50:00","time_end":"2020-04-08 13:10:00","title":"Is Your Machine-Learning Pipeline GDPR-compliant?","lector":"Vladislav Tushkanov","company":"Kaspersky","time_start_gi":"12:50","time_finish_gi":"13:10","tags":[]},{"id":17,"session_id":3,"time_start":"2020-04-08 13:10:00","time_end":"2020-04-08 13:30:00","title":"Wassenaar, You Serious?","lector":"Katie Moussouris","company":"Luta Security","time_start_gi":"13:10","time_finish_gi":"13:30","tags":[]},{"id":18,"session_id":3,"time_start":"2020-04-08 13:30:00","time_end":"2020-04-08 14:30:00","title":"Lunch","lector":"","company":"","time_start_gi":"13:30","time_finish_gi":"14:30","tags":[]}]},{"id":4,"name":"SESSION 13:","leading":null,"order":9,"day_id":6,"lectures":[{"id":23,"session_id":4,"time_start":"2020-04-08 14:30:00","time_end":"2020-04-08 15:00:00","title":"Double Trouble - Emerging Threats in the Middle East","lector":"Dan Caban, Adrien Bataille","company":"Mandiant","time_start_gi":"14:30","time_finish_gi":"15:00","tags":[]},{"id":25,"session_id":4,"time_start":"2020-04-08 15:00:00","time_end":"2020-04-08 15:20:00","title":"Cyber Espionage Under the Scorching Sun: Deep Dive into Middle East Kittens","lector":"Alexey Firsh, Kaspersky","company":"Aseel Kayal, Check Point","time_start_gi":"15:00","time_finish_gi":"15:20","tags":[]},{"id":26,"session_id":4,"time_start":"2020-04-08 15:20:00","time_end":"2020-04-08 15:40:00","title":"TBA","lector":"TBA","company":"","time_start_gi":"15:20","time_finish_gi":"15:40","tags":[]},{"id":27,"session_id":4,"time_start":"2020-04-08 15:40:00","time_end":"2020-04-08 16:10:00","title":"Coffee break","lector":"","company":"","time_start_gi":"15:40","time_finish_gi":"16:10","tags":[]}]},{"id":5,"name":"Session 14: Closing keynotes and Pecha Kucha","leading":null,"order":9,"day_id":6,"lectures":[{"id":30,"session_id":5,"time_start":"2020-04-08 16:10:00","time_end":"2020-04-08 16:40:00","title":"PECHA KUCHA (20 x 20 presentations)","lector":"","company":"","time_start_gi":"16:10","time_finish_gi":"16:40","tags":[]},{"id":31,"session_id":5,"time_start":"2020-04-08 16:40:00","time_end":"2020-04-08 17:10:00","title":"Ending KEYNOTE #1 TBA","lector":"Thomas Rid","company":"Johns Hopkins University","time_start_gi":"16:40","time_finish_gi":"17:10","tags":[]},{"id":32,"session_id":5,"time_start":"2020-04-08 17:10:00","time_end":"2020-04-08 17:40:00","title":"Keynote: Calibrating the Technomoral Compass: Ethical Challenges in Cyber Security","lector":"Carley Tonoli","company":"University of Melbourne","time_start_gi":"17:10","time_finish_gi":"17:40","tags":[]},{"id":28,"session_id":5,"time_start":"2020-04-08 18:00:00","time_end":"2020-04-08 18:00:00","title":"END OF PROGRAM","lector":"","company":"","time_start_gi":"18:00","time_finish_gi":"18:00","tags":[]}]}]}],"tags":[{"id":18,"name":"APT"},{"id":19,"name":"Cybercrime"},{"id":20,"name":"IoT"},{"id":22,"name":"Future threats"},{"id":23,"name":"Nation-State Threats"},{"id":26,"name":"Vulnerabilities"}],"main":{"id":1,"text":"<p>#TheSAS2020 introduces SAS Unplugged – as a way to give back to the security research community.<\/p>","visible_block1":1,"visible_block2":1,"visible_block3":0,"visible_block4":0,"background":"backgrounds\/ee8f9a89a0f087a2a0e6bd64143c0817.jpg","reg_title":"<p>SAS Unplugged<\/p>","reg_date":"<p>April 6-9, 2020<\/p>","reg_text":"<p>SAS Unplugged is a satellite mini-\u0441onference that is part of the whole SAS experience.<\/p>\r\n\r\n<p>SAS Unplugged participants can attend any of the SAS2020 workshops and the SAS Unplugged presentations track.<\/p>\r\n\r\n<p>Also, you'll have a unique opportunity to get career advice from SAS participants and to take part in interactive games and challenges.<\/p>\r\n\r\n<p>SAS2020 closing session will also be available to SAS Unplugged participants, which is a great opportunity to experience the unique and inspiring atmosphere of SAS.<\/p>\r\n\r\n<p>We welcome students, young talents and researchers who just started their career in IT Security as well as matured enthusiasts who are thrilled to experience SAS.<\/p>","background-image":"https:\/\/thesascon.com\/uploads\/backgrounds\/ee8f9a89a0f087a2a0e6bd64143c0817.jpg"},"workshops":[{"id":1,"title":"Hunting using DNS","text":"<p>DNS is the one of the basic layers that holds the Internet together. Without it, not much else works... even malware. In this workshop we will focus on how to use DNS to the advantage of defending networks. With good techniques it is possible to find a great deal of misuse based on DNS such as DGAs, fast\/double flux networks, phishing, and brand impersonation. Tools like passive DNS, whois, and active probing allow defenders to proactively search for malicious<br \/>\r\nindicators before they are operationalized so defenders can get ahead of the attack<br \/>\r\ncycle. This is a workshop on the usage of DNS for malware hunting, detection of new infrastructure, discovery of new network assets and other “research” type of products. In this workshop we will focus on hands on labs while covering also some theory and history of DNS.<\/p>","trainers":[{"id":1,"workshop_id":1,"trainer_id":1}]},{"id":2,"title":"Azeria\u2019s Arm Exploitation Labs","text":"<p>In three action-packed hours we will learn how to read and code in the Arm assembly language and exploit Arm binaries using buffer-overflow exploits. Our lab will involve debugging Arm binaries, executing shellcode from the stack, and how to find and use ROP gadgets to allow exploitation even on NX-protected stacks. This lab includes a detailed workbook and a lab VM.<\/p>\r\n\r\n<p><strong>Outline:<\/strong><\/p>\r\n\r\n<p>• ARM 32-bit Architecture<\/p>\r\n\r\n<p>• ARM Assembly language<\/p>\r\n\r\n<p>• Function calls and subroutines<\/p>\r\n\r\n<p>• Lab: Writing shellcode<\/p>\r\n\r\n<p>• Memory corruption vulnerabilities<\/p>\r\n\r\n<p>• Debugging binaries with GDB<\/p>\r\n\r\n<p>• Lab: Exploiting a Buffer Overflow<\/p>\r\n\r\n<p>• Return Oriented Programming<\/p>\r\n\r\n<p>• Lab: Bypassing NX with ROP - level 1<\/p>\r\n\r\n<p>• Lab: Bypassing NX with ROP - level 2<\/p>\r\n\r\n<p><strong>Prerequisites:<\/strong><\/p>\r\n\r\n<p>• Basic experience with Linux and using the command line<\/p>\r\n\r\n<p>• Basic understanding of how C functions work<\/p>\r\n\r\n<p><strong>What students should bring:<\/strong><\/p>\r\n\r\n<p>• Laptop with 8GB RAM and around 30GB free disk space<\/p>\r\n\r\n<p>• VMware Player\/Workstation\/Fusion or VirtualBox installed.<\/p>","trainers":[{"id":3,"workshop_id":2,"trainer_id":3}]},{"id":3,"title":"Social Networks IOCs Hunting","text":"<p>Mastering IOCs (Indicators Of Compromise) collection and building datasets are some of the most important skills researcher must own when hunting for sophisticated attacks. Ido Naor & Dani Goland, both developers and researchers, will take the attendees into a small mission of building one very useful dataset, collecting IOCs from social networks. In this workshop we will talk about the importance of social networks as an intelligence source and quickly switch to ‘hands on’ group brainstorm, on how to compile your own Twitter IOCs collector for both real-time & historical data. Make sure you have basic level of Python and Regular Expressions. We will also be introducing tools such as Twitter API, Jupyter and Neo4j graphs for visualization purposes.<\/p>","trainers":[{"id":4,"workshop_id":3,"trainer_id":4},{"id":5,"workshop_id":3,"trainer_id":5}]},{"id":4,"title":"VirusTotal for Investigators","text":"<p>This session will demonstrate methods for using VirusTotal data to deep dive into malware campaigns. We will begin by exploring the design and implementation of the newest tools introduced to the VirusTotal arsenal: VTGrep and Graph. The workshop will then progress into discussion around how best to leverage the data available to VT users. By better understanding the breadth and depth of malicious campaigns, researchers and law enforcement can better investigate and mitigate impact. Recently introduced improved relational metadata as well as<br \/>\r\nexpanded retroactive and proactive hunting capabilities allow investigators to dive deep into malware within a global data source.<\/p>","trainers":[{"id":6,"workshop_id":4,"trainer_id":6},{"id":7,"workshop_id":4,"trainer_id":7},{"id":8,"workshop_id":4,"trainer_id":8}]},{"id":5,"title":"Unpacking 101","text":"<p>The training will teach the theoretical concepts behind PE file packers, how to detect a file is packed, how to unpack them, and rebuild the import address table. It will give the attendee enough knowledge of packers that they will be able to unpack UPX, ASPack, PECompact, and even custom malware packers with ease.<\/p>\r\n\r\n<p><br \/>\r\n<strong>Requirements:<\/strong><br \/>\r\n• Basic Knowledge of Reverse Engineering & x86 Assembly<br \/>\r\n• Virtual Machine with Windows XP<br \/>\r\n• Ollydbg v1.10<br \/>\r\n• IDA Pro<br \/>\r\n• Scylla<\/p>","trainers":[{"id":9,"workshop_id":5,"trainer_id":9}]},{"id":6,"title":"Proactive Threat Intelligence and Countermeasures","text":"<p>Historically, IOCs (indicators of compromise) appears as a result of compromise. That creates the illusion that the attacker is always one step ahead of his victim. However, the asymmetry can be removed. Classical methods of collecting and processing attributes of an attacker who has already left his tracks somewhere, can be supplemented and enriched with a new source of IOCs - the proactive Threat Intelligence. The approach can give insights about IP addresses that could be affected with new malware epidemy before it appears in classic IOC feeds. It could give you insight before your resource appears in arbitrary IOC feeds. In turn, with the insights about proactive TI and countermeasures, we will give you the toolset to implement the approach correctly in your infrastructure.<\/p>\r\n\r\n<p><br \/>\r\n<strong>The workshop provides practical guidance<br \/>\r\nfor attendees<\/strong>:<br \/>\r\n• How to enhance existing Threat Intelligence using proactive approach (what methods and tools exist);<br \/>\r\n• How to integrate the approach to current security strategy;<br \/>\r\n• Open-source honeypot-tools review, its implementation and result processing to deliver valuable TI;<br \/>\r\n• Attribution (Tactics, Techniques, and Procedures);<br \/>\r\n• Annoyance of the attacker (TTP).<\/p>\r\n\r\n<p>Who should take this course: System Administrators, web developers, SOC analysts, entry level\/intermediate-level penetration testers, network engineers, security enthusiasts and anyone who wants to take their skills to next level.<\/p>","trainers":[{"id":10,"workshop_id":6,"trainer_id":10}]}]}