CONFidence 2019
2019-06-03..2019-06-04
Kraków, Poland
| title | author | length |
|---|---|---|
| Confidence 2019 - Day One | 01m | |
So, if someone asks us about CONFidence atmosphere and climate, this is it, more or less... ;)
Click for more… | ||
| "Attacking industrial remote controllers for fun and profit" | Dr. Marco Balduzzi | 44m |
Security assessment finds seven vendors of industrial RF remote controllers vulnerable to easy attacks: record-replay works across devices using $40 SDRs, full… | ||
| Cyber Police — What Is It and How Does It Work? | Łukasz Pietrzyk | 20m |
Overview of how the Polish police handle internet-related crimes, describing the units, tools, and tasks involved in cyber investigations. Includes concrete… | ||
| "Latest Android threats and their techniques" | Lukas Štefanko | 30m |
Survey of recent Android malware shows dozens of real Play Store apps that delivered payloads, not just ads: fake wallets and exchanges that steal keys, adware… | ||
| "Vulnerabilities from a grave. Forever dead or maybe alive..." | Michał Sajdak | 42m |
Live demos show Logitech R400 keystroke injection using CrazyRadio plus an external amp and a simple Python script to send arbitrary keys (worked locally and… | ||
| "A rootkits writer’s guide to defense" | Michał Purzyński | 43m |
A phishing incident shows attackers cloning SSO pages and bypassing push MFA; response kills sessions and locks accounts within 20 minutes but reveals 20+… | ||
| "Vulnerabilities for Sale - The Good, the Bad and the Ugly" | Udo Schneider | 39m |
Vulnerability markets split into responsible disclosure channels and secret brokers, with concrete consequences: $30k–$3M zero-day prices drive brokers to… | ||
| Let’s Play a Game – Challenges... | Konrad Antonowicz, Bartosz Dzirba, Dom Storey | 45m |
Shows how to build a low-cost physical mockup that connects a PLC controller to a SCADA environment, then runs a CTF-style attack sequence (reconnaissance… | ||
| "Sneaking Past Device Guard" | Philip Tsukerman | 48m |
Claims multiple practical WDAC/Device Guard bypasses: some require admin, several abuse Microsoft Office without user clicks, and one works from low privilege… | ||
| PowerShell Sandbox — Build It Yourself! | Dawid Pachowski | 41m |
Presentation covers techniques for deobfuscating malicious PowerShell scripts used by malware and droppers, reviewing existing deobfuscation methods and… | ||
| Using Stylometry and Machine Learning... | Edward Szczypka, Wojciech Pilszak | 40m |
The talk covers using stylometry (text analysis to extract characteristic writing features) together with machine learning methods—neural networks, decision… | ||
| AI and cyber, or why your vacuum cleaner (still)... | Kamil Frankowicz | 41m |
The talk explains attacks against artificial intelligence systems, showing consequences of exploiting AI in practice. It contrasts attacking traditional… | ||
| "Advanced Malware Threat: handling obfuscated code using..." | Alexandre Borges | 45m |
Shows a concrete workflow for deobfuscation: small intentionally-obfuscated C examples are transformed back to original logic using assemblers/disassemblers… | ||
| "How Neurodiversity can be Leveraged for an Excellent ROI" | Megan Roddie | 39m |
Companies see concrete gains from hiring neurodiverse staff: 3–4x productivity in some autistic hires, lower churn that avoids 50–290% replacement cost per… | ||
| "A Monitoring Platform for Kubernetes... | Valentine Mairet, Vincent Ruijter | 37m |
A centralised monitoring pipeline collects Kubernetes audit logs (audit policy on kube-apiserver → Fluentd daemonset → Elasticsearch → Kibana) and feeds a… | ||
| Powershell Kung-Fu | Paweł Maziarz | 45m |
Presentation demonstrates offensive uses of Windows PowerShell, showing effective one-liners and multi-line scripts for attackers. It covers PowerShell-based… | ||
| "Breaking Extreme Networks WingOS: How to own millions of..." | Josep Pi Rodriguez | 38m |
Finds a dynamic RC4-derived root password in WingOS that can be computed from a stored file plus the device MAC and then made persistent, reverse engineers… | ||
| SIEM as Needed: Elasticsearch, Energy Logserver, Wazuh... | Szymon Kozak | 40m |
Describes building a customizable SIEM environment tailored to a company’s specific needs using Elasticsearch-based tools. Covers technologies including… | ||
| "Utilizing YARA to Find Evolving Malware" | Jay Rosenberg | 48m |
Shows how to build YARA rules that survive string obfuscation by matching reused machine code rather than literals, using wildcards for registers and offsets… | ||
| Identity Theft — A Problem of the 21st Century Information Society... | Jan Klima | 50m |
The talk explains how identity theft has become a major crime in the digital age, describing how personal data is harvested via social-engineering, malware… | ||
| "Revenge of The Script Kiddies: Current Day Uses..." | Ophir Harpaz, Or Safran | 41m |
Three active bankers show concrete techniques: Gozi/ISFB stops writing executables and writes a PowerShell script into the registry then runs it via a… | ||
| "Inter-application" vulnerabilities - hunting for bugs in..." | Marcin Szydłowski | 39m |
Research shows bugs that span components yield high payoff: using Google dorks, account registration, base64 decoding and simple active scanning uncovers… | ||
| "New Tales of Wireless Input Devices - Matthias Deeg, Gerhard Klostermeier | Matthias Deeg, Gerhard Klostermeier | 52m |
Researchers present concrete failures in 2.4 GHz input devices: seven of nine wireless presenters allow keystroke injection and most accept simple replay… | ||
| "The magic of XSS - not only in web applications" | Michał Bentkowski | 34m |
Demonstrates a real Google Hangouts Chat flaw where an open redirect chain to attacker-controlled domain plus missing address bar lets a link load attacker… | ||
| Social Engineering Attacks in Practice | Borys Łącki | 46m |
Practical examples of social engineering attacks carried out during security tests are presented, showing specific attack methods used in those exercises. The… | ||
| "Inside Cybercrime Groups Harvesting Active Directory for Fun..." | Vitali Kremez | 35m |
Shows concrete malware code paths and operational chains used to harvest Active Directory via LDAP to find credentials, group policy and SYSVOL files for… | ||
| "Playing in the Sandbox: Adobe Flash Exploitation Tales" | Björn Ruytenberg | 36m |
Demonstrates two concrete Adobe Flash sandbox escapes that actually work: a local-with-filesystem bypass using file:// URIs that embed UNC paths so Flash… | ||
| "Into the Fog - The Return of ICEFOG APT" | Chi-en (Ashley) Shen | 48m |
ICEFOG resurfaces with two new families and an n-type payload, totaling roughly nine distinct campaigns since 2014 that target Turkey, the Philippines… | ||
| "Meet Me in the Middle: Threat Indications & Warning to enable..." | Joe Slowik | 41m |
Argues for a usable middle ground between brittle atomic IOCs and months‑late reports: produce verified, minimally contextualized alerts that let SOCs act now… | ||
| "Analysis of the "10 billion" aka Collection #1 password leak" | Kirils Solovjovs | 43m |
Analyzes the Collection #1 assemblage: ~1 TB compressed (≈2 TB extracted), deduplicated to ~900 GB of data and 26 billion records with about 3 billion unique… | ||
| When a framework dies… A case study of CVE-2018-12533 | Daniel Kalinowski | 46m |
A case study of CVE-2018-12533 in the RichFaces Java web framework, showing how specially crafted EL expressions that include a serialized, base64-compressed… | ||
| "Security of the IVR systems and call centers" | Aleksandr Kolchanov | 43m |
IVR (Interactive voice records) - is useful and popular part of a modern call center. They are used not only to present some information (for example, to show… | ||
| CONFidence 2019 - the biggest IT security conference in CEE | 02m | |
☑️ 1300 participants
☑️ 4,21 overall rate out of 5
See you next year!
Find us!
https://confidence-conference.org
https://www.facebook.com/confidence.conferenc… | ||
| What Hacking Can Teach Us from Polish TV Series... | Wiktor Szymański | 35m |
The presentation reviews hacking scenes from recent Polish films and TV series, naming specific topics like Darknet, Wi‑Fi cracking, phone hacking, GPS… | ||
| nothing matches | ||