hacking – Page 541 – STE WILLIAMS

It’s 2019, and from Beijing to Blighty folk are still worried about slurp-happy apps

library
crime | hacking | security

China’s Internet Society chapter has warned local internet app-makers to tone down their collection of personal information.

Last week, the society convened an expert panel with the country’s Information and Communication Administration (part of the Ministry of Industry and Information Technology) to present the results of its analysis of apps popular in China.

What it found will be familiar to anybody who has watched apps in any country: 18 of the most popular apps the society tested collected excessive user information, and in nine cases, that seemed to be taking place without user consent.

Some of those swept up users’ text message archives, their address books, location data, and recordings.

The Internet Society of China report (in Chinese) noted that the revelation led to “heated discussions and comments” between panel members. However, the panel was able to come to the consensus that even if there are still “irregularities”, everybody is at least trying to behave better: “All relevant internet companies have made active efforts to strengthen the protection of users’ personal information.”

The society’s deputy secretary-general, Song Maoen, said the organisation will put together further resources to help its members “carry out self-discipline work on personal information protection, in order to safeguard the legitimate rights and interests of users”.

Among the problematic apps were QQ Music and Kuwo Music, both part of the Tencent Music stable that in December raise over a billion dollars in an IPO, and the Baidu mobile assistant, which was collecting user information without permission.

The news comes hard on the heels of Privacy International raising fresh concerns about app malfeasance outside the Great Firewall.

The London-based privacy advocates said app developers were failing to manage their use of the Facebook SDK, and as a result, apps were frequently sending information sufficient to profile users back to Zuckerberg’s ad farm – even if the individual wasn’t a Facebook user.

It claimed 61 per cent of the apps it tested sent information to Facebook as soon as the app was opened, along with the user’s Google advertising ID. The apps someone routinely uses, Privacy International pointed out, can be enough to create a broad profile of their lifestyle and interests.

Some apps went further, sending detailed information about how users interact with their apps to Facebook – like the Kayak travel booking app, which passed over users’ search and bookings info.

Facebook told Privacy International that since June 2018 it had revised how the SDK’s report-home defaults were configured. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/03/from_beijing_to_blighty_app_privacy_worries_lead_us_into_2019/

Google-whisperers beat reCaptcha voice challenge with 90% success rate

library
crime | hacking | security

University of Maryland researchers have given Google a “welcome to 2019” gift by breaking its latest reCaptcha audio challenge.

The work is a follow-up to an attack published in April 2017 by the university’s Kevin Bock, Daven Patel, George Hughey and Dave Levin, again attacking the audio challenges. Since then, Google has updated the code, and the boffins have updated their attack.

The audio challenge was created to solve reCaptcha’s accessibility problem – someone using a screen reader can’t see where to “tick the box” to prove they aren’t a robot.

The 2017 attack, documented here, downloaded and segmented the audio captcha, sent the segments on to multiple online speech-to-text services, checked the responses for homophones, applied a weighted vote to those responses, and uploaded the answer to reCaptcha.

They claimed better than 85 per cent accuracy for that attack, and when Google fixed reCaptcha’s audio challenge, the group set to work attacking the replacement. They demonstrated that the fixes made reCaptcha less secure, told Google in June 2018 (with a six-month disclosure deadline), and on Monday published unCaptcha2.

The group said: “Thanks to the changes to the audio challenge, [parsing] ReCaptcha is easier than ever before. The code now only needs to make a single request to a free, publicly available speech to text API to achieve around 90 per cent accuracy over all captchas.”

The GitHub post notes that unCaptcha2 no longer needs to use multiple speech-to-text engines, and the fragmentation approach used in the first version has also been abandoned.

The boffins added that Google cleared them to release the code. “The Recaptcha team is aware of this attack vector, and have confirmed they are OK with us releasing this code, despite its current success rate.”

They added: “While unCaptcha2 is tuned for Google’s Demo site, it can be changed to work for any such site – the logic for defeating ReCaptcha will be the same.”

Researchers wanting to check out unCaptcha2 for themselves will need their own API keys from the relevant services (speech-to-text engines from wit.ai, Bing, IBM and Google).

Since Google has had six months’ notice, the boffins noted that unCaptcha2 could stop working at any time. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/03/recaptcha_voice_challenge/

Detailed: How Russian government’s Fancy Bear UEFI rootkit sneaks onto Windows PCs

library
crime | hacking | security

ESET eggheads have shed more light on the Unified Extensible Firmware Interface (UEFI) rootkit being used by the Kremlin’s Fancy Bear hacking crew.

Dubbed Lojax, the software nasty embeds itself within the motherboard firmware of infected Windows PCs, allowing it to run as soon as the machine is powered up or reset, allowing it to ideally spy on the user and evade detection by the operating system or any antivirus tools. The firmware executes at the lowest levels, underneath OS kernels and apps, with full system access.

While ESET blew the whistle on Lojax with a disclosure back in September, the nitty-gritty of how the malware operates was withheld until the annual Computer Chaos Club conference at the end of December, where researcher Frederic Vachon described in a presentation how the UEFI-based rootkit is able to hide in modern firmware. ESET was able to get its hands on a copy of Lojax when one of its customers’ computers picked up the cyber-nasty.

In short, Lojax – a modified version of the legitimate Lojack anti-theft software – starts out as a poisoned application delivered via spear phishing emails that, when run by hoodwinked victims, unpacks and runs code that hijacks a vulnerable driver, which is loaded by the UEFI firmware during startup, to install the rootkit in flash memory.

UEFI has a mechanism called DXE that locates and runs device drivers needed to get a machine going, before the OS is booted. Lojax tampers with one of the loaded drivers so that it flips the switch on the firmware’s write protection, disabling the safeguard and allowing the chips’ contents to be overwritten. At that point, the malware can inject its rootkit into the firmware so that it is run following a subsequent power or reset cycle.

Resident evil: Inside a UEFI rootkit used to spy on govts, made by you-know-who (hi, Russia)

So, the driver is fiddled with so that it unlocks the firmware during next boot, then Lojax alters the flash chip contents to inject its rootkit, and then on next boot, the spyware is up and running. This is because the firmware is expected to maintain its own security.

“The chipset exposes write protection mechanisms that need to be properly protected by the firmware,” he explained. “Because there is no such thing as BIOS write protection by default, it is the job of the firmware to do that.”

In order to turn off the firmware’s write protection, Lojax exploits a known race-condition in Intel’s flash memory controllers by repeatedly enabling BIOS updates and attempting to write to flash memory before the motherboard software steps in and automatically disables updates.

Once that is done, Lojax is able to write the full rootkit on to the UEFI firmware, which ensures the malware is installed and run during the operating system startup, making it nearly impossible to remove by anything short of a complete reflash of the board’s SPI memory.

Fortunately, Vachon notes, vendors themselves can protect against the attack by fixing and patching the driver vulnerabilities, and/or enabling Secure Boot. This will cause the Lojax malware to automatically abort installation attempts. Secure Boot cryptographically ensures the firmware contents isn’t altered. Also, not opening emailed applications as a system administrator helps a lot: the rootkit installer requires sysadmin access. However, it could exploit privilege escalation holes to gain admin control, so the real solution is enabling Secure Boot in the BIOS settings and set a password or other lock to prevent any changes.

“The tool only works if the platform is misconfigured,” he explained. “If firmware vendors would have done their job correctly here, this tool would have failed at flashing the firmware, it’s a great example of how [important] firmware security is.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/02/lojax_uefi_rootkit/

Hacker cyber-gang: Give us cyber-cash for cyber-cache of 18,000 stolen Sept 11th insurance docs

library
crime | hacking | security

The hackers who claim to have breached a British insurer last year say their cache of pilfered files include confidential documents on the September 11 terrorist attacks.

The Dark Overlord group claims a collection of 18,000 files, lifted from British insurance company Hiscox, include insurance claims that Lloyd’s of London and Silverstein Properties handled in the aftermath of the 2001 attacks that killed 2,977 innocent people and 19 terrorists during the destruction of both towers at New York City’s World Trade Center and the attack on the Pentagon. Silverstein owns the World Trade Center complex.

“What we’ll be releasing is the truth. The truth about one of the most recognisable incidents in recent history and one which is shrouded in mystery with little transparency and not many answers,” the hacker group said.

“What we’re offering to the world is the truth, exclusively from us, one of the planets premier hacking organisations dedicated to breaching leading targets and acquiring the most scandalous materials that we may use in our systematic extortion campaigns.”

The Dark Overlord group has previously claimed to have hacked Netflix (an allegation that was denied by Netflix) and a UK plastic surgery clinic.

Hiscox has confirmed at least some of Dark Overlord’s boasts about obtaining the insurance files are true, acknowledging that documents related to 9/11 insurance cases were swiped during an April 2018 cyber-raid on a law firm Hiscox worked with.

“The law firm’s systems are not connected to Hiscox’s IT infrastructure and Hiscox’s own systems were unaffected by this incident,” Hiscox said on Monday.

“One of the cases the law firm handled for Hiscox and other insurers related to subrogation litigation arising from the events of 9/11, and we believe that information relating to this was stolen during that breach. Once Hiscox was made aware of the law firm’s data breach, it took action and informed policyholders as required. We will continue to work with law enforcement in both the UK and US on this matter.”

Silverstein Properties, meanwhile, was unfazed by the claim.

Chill, it’s not WikiLeaks 2: Pile of EU diplomatic cables nicked by hackers

“We are aware of claims of alleged security breaches at firms involved in the five-year insurance litigation following the attacks of 9/11, and are conducting an internal investigation based on these claims. To date, we have found no evidence to support a security breach at our company,” a spokesperson told The Register.

“We have spent the last 17 years fulfilling our obligation to deliver a magnificent and fully rebuilt World Trade Center. We will not be distracted by 9/11 conspiracy theories.”

Lloyd’s of London did not return a request for comment.

DarkOverlord says the pilfered files will be offered up to anyone and everyone willing to pay for them in Bitcoin, while the companies named in the cache can cough up some BTC to get specific items removed from the doc dump.

“The good news for you is that we’ll be selling these documents for a limited time,” the group said. “If you’re a terrorist organisation such as ISIS/ISIL, Al-Qaeda, or a competing nation state of the USA such as China or Russia, you’re welcome to purchase our trove of documents.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/03/911_insurance_claim_hack/

US-CERT Offers Tips for Securing Internet-Connected Holiday Gifts

library
crime | hacking | security

Key steps to making those home Internet of Things devices just a bit safer.

The Department of Homeland Security’s US-CERT has welcomed the new year with advice to those who received Internet-connected devices as holiday gifts.

In a US-CERT alert issued Dec. 28, the National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), provided consumers with several security steps to take with their new Internet of Things devices.

Consumers should create strong passwords for their devices, and then to carefully evaluate all security settings. Make sure that software and firmware is fully patched and up to date, and remember that the Internet is a big (virtual) place that’s not always friendly, so connections should be made with care, according to the US-CERT alert.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/iot/us-cert-offers-tips-for-securing-internet-connected-holiday-gifts/d/d-id/1333573?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Data on 997 North Korean Defectors Targeted in Hack

library
crime | hacking | security

Nearly 1,000 North Koreans who defected to South Korea had personal data compromised by an unknown attacker.

A cyberattack by an unknown actor compromised personal information belonging to 997 North Koreans who defected to South Korea, Reuters reports.

The South Korean Unification Ministry disclosed the incident after hackers broke into the database of the Hana center, one of 25 institutes the ministry runs to help defectors with jobs, medical support, and other assistance they need to build their lives in South Korea. Actors reportedly added malware to emails sent from an internal address to infect a ministry machine.

The attack compromised names, birthdates, and addresses of nearly 1,000 people who defected from North Korea to South Korea. Officials did not say whether North Korea was responsible. Defectors affected in the attack are being notified, the ministry says.

AI in Security Carries as Many Questions as Answers

library
crime | hacking | security

Companies are adopting machine intelligence even though there are still issues and questions regarding its performance, a new report on AI use in cybersecurity shows.

Nearly three-quarters of all organizations have implemented security projects that have some level of intelligence built in. And the more security alerts a company sees in a day, the more likely it is to look to machine intelligence in order to deal with the flood.

Those are just two of the conclusions reached in a new white paper, “The State of AI in Cybersecurity: The Benefits, Limitations and Evolving Questions,” published today by Osterman Research. The report, based on more than 400 surveys of organizations with more than 1,000 employees, asked questions about the use of AI and the results of that use.

“AI is certainly, thanks to very strong marketing, winning the hearts and minds, not of the practitioners but of the broader executive suite,” says Ramon Peypoch, chief product officer of ProtectWise, which sponsored the Osterman research. “They’re being taken with the idea of allowing teams to do more and be more productive.”

While companies are definitely employing machine intelligence in security, the perception of its value is not universally positive. According to the report, 60% of organizations employing AI think that AI makes investigations of alerts faster. The same proportion report that AI improves the efficiency of their security staff.

The more an organization employs machine intelligence, the more positive its perception of the technique’s effectiveness. In companies that have deployed machine intelligence in 10% or less of their security applications, 49% see it speeding their research of alerts. In those companies employing machine intelligence in more than 10% of their security, that number rises to 69%.

Still, machine intelligence isn’t perceived as perfect. Some 60% of responding organizations say that it doesn’t deal with zero-day or advanced threats, and roughly half complain that it generates too many false positives. These issues are due at least partially, say some experts, to the difficulty in properly training machine learning engines.

“You have very few machine learning professionals that can handle and clarify and gain meeting from the data,” says Heather Lawrence, a researcher at the Nebraska Applied Research Institute. She points out that machine learning professionals are rarely experienced in cybersecurity, while cybersecurity experts tend to have no real data science experience. The disconnect slows improvement and wide, effective deployment. “You still need somebody who can understand the data going in and the data going out. It hasn’t yet been automated to a point where you can remove the professional to actually get meaning from the data,” Lawrence explains.

Peypoch looks at data in the report and sees future progress that is almost inevitable. “AI is one tool for driving efficiencies. It can make your limited staff more effective, but it’s not going to replace human staff anytime soon,” he says. “AI is an approach, a journey for most organizations deploying it, and I think we’re at an early point of deployment, of maturity and sophistication.”

Searching for a ready metaphor for the current state of adoption, Peypoch turns to sports. “I don’t think we’re even in the first inning; the teams are still on the field warming up prior to the game starting.”

Related content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/network-and-perimeter-security/ai-in-security-carries-as-many-questions-as-answers/d/d-id/1333571?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cyberattack Halts Publication for US Newspapers

library
crime | hacking | security

A virus disrupted print and delivery for the Chicago Tribune, Los Angeles Times, Baltimore Sun, and other US publications this weekend.

Several major US newspapers are kicking off 2019 responding to a cyberattack that caused print and delivery problems for publications owned by Tribune Publishing, including the Chicago Tribune and Baltimore Sun, as well as the Los Angeles Times.

Few details are still known about the attack, which hit printing plants in Los Angeles and various Tribune Publishing papers across the country, the Associated Press reports. The incident caused delays for some publications; others were forced to cut certain portions of content.

“This issue has affected the timeliness and in some cases the completeness of our printed newspapers,” said Tribune Publishing spokeswoman Marisa Kollias in a statement to the AP. For example, the Chicago Tribune ran Sunday, December 30, without classifieds or paid death notices. Some papers were forced to cut content and distribute Saturday papers on Sunday instead.

In Los Angeles, the attack prevented timely delivery for the Los Angeles Times, San Diego Union Tribune, and other newspapers to certain recipients. Both the Los Angeles Times and San Diego Union Tribune were sold to Dr. Patrick Soon-Shiong in 2018; however, the New York Times reports the two publications still use their old parent company’s printing networks.

It’s worth noting the attack only affected printed papers, Kollias noted. Websites and mobile applications for targeted publications were not targeted by this attack.

According to a Los Angeles Times report, several people with knowledge of the attack say it appears to be “Ryuk” ransomware. An individual from the company who did not have permission to comment publicly said corrupted files had the “.ryk” extension.

Ryuk targeted several enterprises in August 2018, encrypting hundreds of machines, storage, and data centers in each. Its technical capabilities are “relatively low,” Check Point Research reports, but some businesses paid big ransoms to get their files back. Analysts linked this particular Ryuk campaign, and some of its inner workings, to the Hermes ransomware — a form of malware frequently connected to the North Korean APT Lazarus Group, they explain.

Unlike common ransomware, Check Point previously said Ryuk is exclusively used for tailored attacks. “In fact, its encryption scheme is intentionally built for small-scale operations, such that only crucial assets and resources are infected in each targeted network with its infection and distribution carried out manually by the attackers,” researchers write in a report on Ryuk.

Tribune Publishing has not issued a formal statement describing the threat found on its network. However, if Ryuk was the malware used here, Tribune wouldn’t be the only company facing this threat. On January 2, KrebsOnSecurity reported Data Resolution, a cloud hosting provider, was bringing its systems back online after Ryuk ransomware hit on December 24, 2018.

The report states Ryuk was the same malware strain that targeted US newspapers. Following the incident, Data Resolution shared an update with affected users to say attackers compromised a login account to infect servers with Ryuk ransomware. The company, which has about 30,000 business customers around the world, says there is no sign data was stolen.

The Washington Post reports Tribune is still investigating the malware, which affected a part of its back-office systems, Kollias said in a statement. Tribune has also reported the attack to the FBI, the Chicago Tribune says. So far, Kollias said to the Chicago Tribune, there is no evidence indicating customer credit card data or personally identifiable information had been affected.

For those keeping an eye on the Tribune attack, there remain more questions than answers. We still know little about who may be behind the incident, whether they may be linked to foreign governments, what their motivations are, or how, exactly, they successfully broke in.

Tribune Publishing declined to comment for this article.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/perimeter/cyberattack-halts-publication-for-us-newspapers/d/d-id/1333575?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Ex-NSA Contractor Was a Suspect In Shadow Brokers Leak

library
crime | hacking | security

New court document shows law enforcement suspected possible involvement of Harold Martin in Shadow Brokers’ release of classified NSA hacking tools.

A new court opinion, first reported on by Politico, shows that Harold Martin, a former NSA contractor whom some have previously speculated was the individual behind the leaks of some highly classified NSA hacking tools in 2016, was indeed a prime suspect in the case.

Martin was arrested in August 2016 after law enforcement agents raided his home near Baltimore, Maryland, and discovered nearly 50 terabytes of government data, including documents marked “Secret” and “Top Secret,” in his possession.

His arrest came just days after an outfit calling itself the Shadow Brokers publicly released several highly-classified NSA offensive hacking tools and exploits and offered to sell more stolen tools via auction to any interested parties. Up to now, the government has not said if the documents in Martin’s possession at the time of his arrest included the NSA hacking tools. Neither has law enforcement explicitly identified Martin as being involved in the Shadow Brokers leak.

A federal grand jury last February indicted Martin on 20 counts of willfully retaining national defense information. His trial is scheduled to start June 2017.

Martin initially admitted to taking government documents from the workplace and bringing them home without authorization. He later filed a motion seeking to suppress certain evidence gathered from his home as well as his own statements to FBI agents.

Court Filings

In a 19-page opinion, the US District Court for the District of Maryland recently denied Martin’s bid to suppress the evidence from his home as well as cell-site location information collected from his mobile service provider. However, the court upheld Martin’s motion to suppress his statements to the FBI on the grounds that it was obtained without a Miranda warning.

The latest court document does not shed much new light on Martin’s involvement in the Shadow Brokers leak, but it does make clear that the raid on his house, and the subsequent arrest, happened because law enforcement at least suspected his involvement in the matter.

The court’s document shows that the August 2016 raid on Martin’s home was prompted by some Twitter messages that Martin posted suggesting he had knowledge about the NSA hacking tools. The Twitter messages were posted shortly before the Shadow Brokers publicly leaked the first set of tools and announced their intention to auction off the rest.

The FBI used that fact to justify its request for a warrant to collect information associated with Martin’s Twitter account and for a separate warrant to search Martin’s resident, person, and vehicles. In making a case for the search warrants, the government also showed that Martin, in his role as an NSA contractor, had had access to the hacking tools that the Shadow Brokers had put up for sale.

“In this case, there was a substantial basis for the Magistrate’s finding of probable cause to issue the search warrant for information associated with the Defendant’s Twitter account,” District Judge Richard Bennett wrote in explaining his decision to deny Martin’s motion to suppress evidence. The fact that Martin posted his messages just hours before Shadow Brokers made it publicly available, combined with his access to the documents also made the warrant justifiable, the judge said.

“Thus although the Defendant’s Twitter messages could have had any number of innocuous meanings in another setting, these allegations regarding the context of Defendant’s messages provide a substantial basis for the Magistrate’s conclusion that there was a “fair probability” that evidence would be found in Martin’s possession, he said.

Insider Threat

Martin’s illegal activities are believed to have begun in 1996 and continued through his arrest in 2016. Over that period he misappropriated literally millions of pages of government data and stored them at home in various formats. Previous court documents have described him as an individual who had the security clearance to work on highly classified projects that gave him access to sensitive documents and government secrets. Prosecutors have noted how Martin, as a trusted insider, was able to easily bypass the many expensive controls that the NSA and other government agencies he worked for had implemented to protect data.

The tools and exploits that the Shadow Brokers leaked back in 2016 continue to be widely used even today. The leaked exploits included zero-day exploits and exploits that target vulnerabilities in a wide range of firewalls and other network products.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ex-nsa-contractor-was-a-suspect-in-shadow-brokers-leak/d/d-id/1333576?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Train for the fight against cybercrime at SANS London 2019

library
crime | hacking | security

Promo As new and ever more inventive threats keep crowding over the IT horizon, the security professional is under constant pressure to stay ahead of the cybercriminals.

Prepare to meet whatever the attackers throw at you at SANS London 2019 from 11-16 March, where you can choose between 10 intensive training courses, tailored to suit all levels from novice to seasoned expert.

All provide the chance of gaining valuable GIAC certification and arm attendees with defensive and offensive skills that can be put into practice immediately.

These are the courses on offer.

Introduction to cyber security

Students with no prior cybersecurity experience can jump-start their education with this basic five-day course covering terminology, networks, security policies, incident response, passwords and cryptography.
Security essentials bootcamp style

Would you be able to find compromised systems on your network? Do you know if each security device is configured correctly? Are proper security metrics set up and communicated to your executives?
Hacker tools, techniques, exploits and incident handling

Follow a step-by-step response to computer incidents and learn about legal issues such as employee monitoring, working with law enforcement and handling evidence.
Continuous monitoring and security operations

It is no longer enough to rely on perimeter security. Once attackers can find a way into an organisation they will be able to achieve their nefarious goals. Find out how to detect anomalies that indicate criminal behaviour so you can nip intrusions in the bud.
Mobile device security and ethical hacking

Mobile devices are often an organisation’s biggest security worry. Learn about the strengths and weaknesses in Apple iOS and Android devices and how to communicate risks to key stakeholders.
Advanced Web app penetration testing, ethical hacking and exploitation techniques

Modern web applications are increasingly sophisticated and complex. Learn about new web frameworks and backends, dig deep into practical cryptography, and examine new protocols such as HTTP/2 and WebSockets.
Advanced penetration testing, exploit writing and ethical hacking

Aimed at those who already have penetration testing training and experience. Walk through dozens of real-world attacks and consolidate your knowledge with hands-on lab work.
Advanced digital forensics, incident response and threat hunting

Determined adversaries can get past monitoring tools so it’s important to catch intrusions in progress rather than after attackers have done their worst. Study the art of recognising criminal behaviours to identify data breaches.
Advanced memory forensics and threat detection

This course on Windows memory forensics for incident response investigators uses the most effective freeware and open-source tools to examine RAM content to reveal the story of what happened on a system.
Secure DevOps and cloud application security

How to build and deliver secure software using DevOps and and Amazon Web Services using popular open-source tools such as GitLab, Puppet, Jenkins, Vault, Graphana, and Docker.

More information and registration details here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/02/sans_london_2019/