NDC Security 2024
2024-01-09..2024-01-10
Oslo, Norway
[NDC Security 2022, NDC Security 2023, NDC Security 2024, NDC Security 2025, NDC Security 2026]
| title | author | length |
|---|---|---|
| PAR: Securing the OAuth and OpenID Connect Front-Channel | Dominick Baier | 50m |
Pushed Authorize Requests move all authorization parameters from the browser URL into a back‑channel PAR endpoint so the client authenticates before the… | ||
| The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery | Philippe De Ryck | 52m |
Cross-site forgery is largely neutralized by SameSite cookies for typical cookie-auth apps, but APIs remain vulnerable because forms and fetch can deliver… | ||
| Keynote: How I Met Your Data | Troy Hunt | 01h 00m |
Ten years of indexing breaches becomes a searchable repository of emails now holding 700+ incidents and practical rules like a sensitive flagging workflow that… | ||
| Panda to gibbon is the least of your worries: why securing AI is not what you think | Sarah Young | 47m |
Argues that most AI risk comes from normal security failures not magic attacks, cites the panda to gibbon adversarial example (57.7%→99.3%), and says 98% of… | ||
| AWS Security Reference Architecture: Visualize your security | Mohamed Wali | 01h 00m |
AWS SRA provides prescriptive multi-account patterns plus a deployable code library that uses CloudFormation only (no Terraform support) to spin up a Security… | ||
| Detecting Malicious Activity: Unveiling the Secrets of MS-SQL Logging | Tristan Bennett | 52m |
Detects concrete MS‑SQL abuse patterns by deploying a repeatable 8–12 week audit configuration and simple detections, shipped as SQL scripts and JSON tests on… | ||
| Linux Namespaces for Fun and Isolation | Martin Ertsås | 01h 03m |
Machine examples use unshare with CLONE_NEWUSER and show writing /proc/self/uid_map and /proc/self/gid_map (and echoing "deny" to /proc/self/setgroups) so an… | ||
| Red Teaming Large Language Models | Armin Buescher | 59m |
Red teaming runs 17 seven‑billion models with three curated datasets (520 refusal prompts, 100 leading questions, CN50) plus 20 generic jailbreaks and… | ||
| Breaking Barriers: Empowering Women to Thrive in Cyber Security | Katie McMillan, Samia Durrani | 58m |
Data points and concrete actions: industry data says 25% of cyber workforce and progress stalls since 2019; a school session with 50 girls finds five of 50… | ||
| Incidents and incident handling @ VG.no | Audun Ytterdal | 46m |
VG runs a written IMAS incident framework plus tooling: a live incident document (LID) auto-created with Slack/Google Drive links, bots to open channels and… | ||
| Developing secure software with GitHub | Laura Kokkarinen, Thomas Vochten | 01h 02m |
Demonstrates concrete GitHub features and limits: secret scanning (scans history, public repos free, private repos need GitHub Advanced Security), push… | ||
| Effects Malware hunting in Cloud environment | Filipi Pires | 01h 03m |
Shows a reproducible chain: a malicious PDF (one sample has 15 objects, 2 streams, 5 JS refs) uses a magic number trick to bypass upload checks, embeds… | ||
| Asymmetric Encryption: A Deep Dive | Eli Holderness | 56m |
Mathematical mechanics of asymmetric crypto are shown with concrete numbers: RSA example n=323 (17×19), e=5, d=29 and a worked ECDSA signing over a tiny field… | ||
| Empowering Security Teams with Generative AI | Roberto Rodriguez | 01h 07m |
Overview of concrete work: demos show tokenization and embedding with Transformers, a local stack using Ama + LightLLM and a Seer 7B model, and cloud calls to… | ||
| Leveraging graph AI and GPUs to win the US Cyber Command AI challenge | Leo Meyerovich | 53m |
First-place system for the US Cyber Command Alert AI Challenge combines graph correlations, UMAP embeddings and graph neural nets with GPU ETL and a GPU… | ||
| Threat Modelling for ML/AI systems | Andrea Brambilla, Benjamin Løkling | 41m |
Two-hour workshops adapt threat modeling for ML/AI by splitting training vs inference, running on Azure, and producing concrete fixes: disable Microsoft abuse… | ||
| 52 mins from initial access to ransomware - is your defensive team ready? | Maarten Goet | 55m |
Shows a real incident where attackers go from initial access to full encryption in 52 minutes from initial access to encryption, using Cobalt Strike C2, MFA… | ||
| Optimizing Cloud Detection & Response With Security Chaos Engineering | Kennedy Torkura | 37m |
Security chaos engineering runs agentless experiments through Mitigant Cloud Immunity against AWS and Datadog, using GuardDuty and Detective plus Datadog Cloud… | ||
| Purple is the New Black: Modern Approaches to Application Security | Tanya Janca | 57m |
Practical checklist for modern app security: adopt zero trust and assume breach design, log everything and feed serverless and workflow logs into a SIEM, front… | ||
| The Top 10 List of Istio Security Risks and Mitigation Strategies | José Carlos Chávez | 45m |
CNCF’s community top‑10 frames Istio risk as configuration and operational failures rather than a flaw in the mesh: misconfigurations and permissive modes… | ||
| Unlocking The Secrets Of TLS | Scott Helme | 45m |
Explains why the old RSA key exchange fails: if a server private key is ever exposed (Heartbleed 2014 or compelled disclosure like the Snowden-era cases)… | ||
| OWASP Juice Shop - An Open Source Software and security Fairytale | Björn Kimminich | 01h 01m |
OWASP Juice Shop starts as a 2014 pet project and now ships a realistic web shop with 106 hacking challenges (expanded into ~137 tasks including coding… | ||
| The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery | Philippe De Ryck | 52m |
CSRF remains real for cookie-based auth: demos show hidden-form and fetch attacks creating reviews against a legacy app and an API, and real incidents include… | ||
| Social engineering pentesting. - How it is done, and what you should think about | Ragnhild "Bridget" Sageng | 01h 03m |
A physical social‑engineering pentest shows how open sources and small props get real access: the tester uses printed blueprints, a fake email pretext with a… | ||
| OAuth2/OIDC security weaknesses and pitfalls | Tobias Ahnoff, Pontus Hanssen | 53m |
Shows live demos using Burp Suite, IdentityServer and Keycloak: a cross‑site scripting exploit loads attacker JavaScript that creates a silent renew iframe to… | ||
| Passwords are Dead, Long live Passkeys! | Stephen Rees-Carter | 52m |
Passkeys replace passwords by generating a public/private keypair in a local authenticator (Windows Hello, phone or password manager) and sending only the… | ||
| Finding a three 0-day exploit chain in Ivanti EPMM and Ivanti Sentry | Tor E. Bjørstad | 58m |
Three chained 0-days let attackers move from internet to root on Ivanti appliances: CVE-2023-35078 (auth bypass, CVSS 9.8) exposes REST endpoints by abusing an… | ||
| The Future of Cookies | Anders Abel | 50m |
Timeline of browser changes and concrete breakages: Chrome moves cookies to SameSite=Lax default (2020) then delays and progressively rolls out third‑party… | ||
| Prompt Injection: When Hackers Befriend Your AI | Vetle Hjelle | 51m |
Demonstrates concrete exploits: direct and indirect prompt injection lets attacker-controlled text change a model’s behavior (including stored web content and… | ||
| Banking Cybersecurity: Battling DeepFakes & AI-powered Scammers | George Proorocu | 40m |
Four attack scenarios with two live demos show how modern deepfakes enable targeted fraud: real-time video impersonation to push a seven-figure transfer… | ||
| The Hidden Risk in Undocumented API Behavior | Bahaa Naamneh | 49m |
Undocumented Windows registry symbolic links cause deletion APIs to remove the target not the link, letting a non‑admin create a link under writable keys and… | ||
| Automating security monitoring | Truls Dahlsveen | 50m |
Shows concrete automations: automated URL enrichment with VirusTotal and MISP threat‑intel lookups, analytic rules in Microsoft Sentinel that group duplicate… | ||
| Surprising ways to escalate privileges in Entra ID | Marius Solbakken Mellum | 53m |
Entra ID has 105 roles and common misconfigurations let low‑privilege accounts escalate to Global Admin by adding app credentials or abusing delegated scopes… | ||
| Measuring the Wrong Metric – Lessons from Attacks on Critical Services | Munish Walther-Puri | 55m |
Proposes a practical rubric that measures cyber impact by scale scope speed rather than headlines, and applies it to two incidents: Costa Rica (27 agencies… | ||
| NIS2 & CRA: Europe's Response to Cyber Shenanigans | Tudor Damian | 01h 01m |
NIS2 widens coverage from 30 → 67 sectors, forces member states to transpose the directive by October 17 and imposes 24h / 72h / 30d reporting (early warning… | ||
| Passwords don't have to be so hard! | Stefán Jökull Sigurðarson | 50m |
This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity #ndcconferences #security #developer #softwaredeveloper
Attend the next NDC… | ||
| Pentesting Azure Container Services | Sergey Chubarov | 59m |
Live demos show downloading an Azure Container Registry image, extracting layer.tar, inserting a shared object and LD_PRELOAD to get a reverse shell… | ||
| Stories from NC3 - investigating hackers | Sindre Breda, Åge Strand | 01h 00m |
When forensics logs prove useless a bespoke extractor parses Cobalt Strike folders, deserializes serialized Java objects from .bin snapshots and correlates… | ||
| Second Breakfast: Implicit and Mutation-Based Serialization Vulnerabilities in .NET | Jonathan Birch | 44m |
Demonstrates concrete remote code execution across .NET serializers: proven RCEs against LiteDB, MongoDB, RavenDB, ServiceStack.Redis and MartenDB using… | ||
| Hacked in hours: Red team assessments unveiling vulnerabilities | Rico Komenda | 54m |
Claims that red teams breach both physical and technical defenses within hours, supported by concrete numbers: 136,000 reported cybercrimes (Germany 2022)… | ||
| Tune your Toolbox for Velocity and Value | Josh Grossman | 56m |
Organization is buried in SAST DAST and SCA results with false positives, no triage and no metrics; fixes focus on tool tuning, inventory and process change… | ||
| Assessing NuGet Packages more easily with Security Scorecards | Niels Tanis | 54m |
OpenSSF Scorecards runs automated checks and rates projects 0–10 so maintainability and build risks become measurable; the CLI and dev.dev API already embed… | ||
| Sandboxing in Linux with zero lines of code | Ignat Korchagin | 38m |
Claims a way to sandbox any Linux binary without changing its source by injecting seccomp policies at runtime; demonstrates a toolkit with a shared library… | ||
| Trapping a Scammer | Stephen Rees-Carter | 09m |
A recipient gets three separate offers to buy the .com of a domain already owned as .net, then probes for proof and compares timestamps: WHOIS creation… | ||
| Ambitious S SDLC at Norway's biggest home construction company | Hans Ove Ringstad | 08m |
A rollout of a company-wide secure software development lifecycle at UBOS mandates asset classification, continuous OSS scanning with defined patch deadlines… | ||
| No Size Fits All: Empowering Engineers with Custom Application Security tests | Michal Kamensky | 42m |
Demonstrates creating a few-line custom tests using Semgrep for static checks and Nuclei for dynamic probes, with concrete examples: a rule that finds missing… | ||
| nothing matches | ||