Below is a re-print of the interview I gave to CIO-World that cover featured me in the "Europe's Most Influential CISOs of the year 2024". The Original can be found here.

TLDR - I talk about Essential Skills for a CISO, how regulation can achieve bolstering resiliency and security, essential Skills for Effective CISO Leadership, Advice to Navigate the C-Suite, how to navigate the Evolving Intersection of Technology and Compliance.

As financial technology (FinTech) evolves rapidly, it faces an increasing number of cyber threats. Cybercriminals are constantly finding new ways to exploit weaknesses in payment systems, putting billions of dollars and countless identities at risk. A staggering statistic reveals that up to 75% of customers worldwide now use at least one FinTech service, a number projected to grow as more people embrace digital payments and online banking.

Source: CIO World

Meet Thierry Zoller, the Chief Information Security Officer at J.P. Morgan Mobility Payments Solutions S.A. (Red. now Julius Baer) , whose mission is to stay one step ahead of these digital predators. With nearly three decades of experience in cybersecurity, Zoller brings a unique blend of technical expertise and strategic vision to one of the world’s largest financial institutions. His journey from a curious teenager in Luxembourg to a leading figure in global information security is an example of the power of passion and perseverance.

Thierry’s fascination with technology began early, driving him to explore the inner workings of systems and networks. This curiosity led him to dive deep into reverse engineering and system vulnerability analysis, skills that would become invaluable in his future roles.

His career has been marked by a series of high-profile positions, including Head of Security Risk and Compliance Europe for Amazon and CISO for Amazon Payments. These experiences have honed his ability to navigate the complex intersection of technology, finance, and security.

At J.P. Morgan, he faces his most challenging task yet: securing the future of mobile payments in an increasingly cashless world. His approach combines futuristic technology with a deep understanding of human behavior, recognizing that the weakest link in any security system is often the user.

Thierry’s impact extends far beyond his corporate role. As a prolific blogger and researcher, he has coordinated the disclosure of over 100 vulnerabilities and released numerous free security tools. His work has been cited in books and peer-reviewed papers, cementing his status as a thought leader in the field.

The 45-year-old security expert’s commitment to knowledge sharing has been a cornerstone of his career. This philosophy drives his continued efforts to educate and empower the next generation of cybersecurity professionals, contributing significantly to the global information security community.

Let us learn more about his journey:

The responsibilities of vendors, suppliers, and service providers have grown increasingly important in the dynamic digital economy. The growing digitalisation and reliance on third-party entities significantly enhances business operations while concurrently introducing a spectrum of security risks. 

Recognising these challenges, regulatory supervisors have been actively creating frameworks over the years to make sure that financial entities in particular appropriately handle and mitigate the risks of security incidents that could directly affect their operations.

The adoption of specific guidelines by the European Banking Authority (EBA) in marked a substantial acceleration of the shift towards a more security-conscious approach when interacting with third parties. These guidelines were a significant advancement in highlighting the important security aspects to take into account while working with third parties. 

However, with the recent final Regulatory Standards published, the Digital Operational Resilience Act (DORA) is further evolving the requirements and expectations in light of multiple high-profile breaches involving third parties and the supply chain. The entry into force of this European Regulation, which takes effect in January 2025, marks the beginning of a new era in third party security management. 

It signals a time when strict compliance and proactive risk management are more important than ever in third-party contacts, and it also emphasises the significance of operational resilience and indicates a heightened response to the changing threat landscape.

While researching the state of the Art in "Third Party" risk management I came across an Report recently published by Wade Baker, Ph.D. and the Cyentia Institute titled “Risk to the Nth-Party Degree: Parsing the Tangled Web".

In true Cyentia Institute fashion the report is a data driven and provides plenty of opportunity for the data science geeks amongst us to rejoice - for the others it's one of the first publicly available reports providing us with data analysis on the matter with.

The Report highlights a crucial aspect that is often overlooked in risk management: vendor risk extends beyond direct third parties.

What really is "third party" risk ?

What is Psychological Safety ?

Amy Edmonson - TED Talk (Building a psychologically safe workplace) https://www.youtube.com/watch?v=LhoLuui9gX8

Cybersecurity in M&A 

A Growing Priority for Decision Makers

Key Findings

Transparency 🚫 - An undisclosed data breach is a deal breaker for most companies: 73% percent of respondents agreed that a company with an undisclosed data breach is an immediate deal breaker in their company’s M&A strategy

Plan for continuous assessments 🔄 - Decision makers sometimes feel they don’t get enough time to perform a cyber evaluation. Only 36% of respondents strongly agree that their IT team is given time to review the company’s cybersecurity standards, processes and protocols before their company acquires another company. The results emphasize the importance of proper evaluation and time in ensuring successful M&A outcomes.

Acquisition Regrets🤦- 65% of respondents regret their M&A decisions due to cybersecurity concerns. Failure to address cyber risk can lead to major acquisition regrets: Nearly two-thirds of respondents (65%) said their companies experienced regrets in making an M&A deal due to cybersecurity concerns.

Integration Delays⏲️- 49% encountered unknown or undisclosed cybersecurity issues, causing M&A timeline delays. 54% reported minor delays and losses under $1 million; 50% faced major delays with similar financial impact.

Significant Losses💸 - 22% experienced losses over $1 million due to cybersecurity incidents.

• LU: "Et hätten ni Deeg ginn zu Lëtzebuerg, an deene keng Nei-Infektiounen derbäi sinn."
  EN: "There has not been a single day in Luxembourg that we did not have new infections"
  
  Ed. : Unfortunately, that's just a basic fact of life (and science for that matter). There won't be any day that there are no (0) new viral infections in Luxembourg. It is dangerous to think or portray the short term (or even long term) goal as having no (0) infections. That's a matter of impossibility. If interested see my prior post about some of the dynamics [3]

• LU: "D'Zuelen schwätzen eng kloer Sprooch an d'Wëssenschaft kann nëmmen weider un d'Leit appelléieren, d'Mesuren anzehalen a sech testen ze loossen "
  EN:  The numbers speak a clear language and science can only continue to plead to the people, follow the measures.
  
  Ed. : This diatribe has 0 content that is convincing or conveying the "Why". If anything, what follows points to science not speaking a clear language.


• LU: Déi nei Fäll sinn haaptsächlech duerch Infektiouns-Cluster gedriwwen, dat heescht duerch grouss Usammlungen vu Leit. Manner an de Schoulen, mä éischter op de Partyen. Et gëtt awer och sporadesch Fäll vu Persounen, déi sech am enke Kontakt mat Aneren ugestach hunn. Dat Ganzt wier ebe gedriwwen duerch sozial Kontakter
  
  EN: The new positive tests are mainly rooted in infection clusters, meaning a big gathering of people. It is less the Schools but more partys. There are however also "sporadic" cases of people that infected each other through close contact. The pandemic is driven through social contacts.
  
  Ed: We learn that the Virus prefers Partys, and the Virus dislikes Schools. We also learn that "social contacts" are the problem. It is evidently the physical distance, not social contact.
  N.B this follows right after the "science speaks a clear language" diatribe.

• LU: Eng Tracing- App wier en effikasst Instrument, confirméiert de Mikrobiolog.
  EN: He confirms that a tracing app is an efficient/effective mechanism
  
  
  Ed:  We learn that tracing-apps are effective - although all data points to the Opposite. As an example, the Germany Corona app had over 14 million downloads. It alerted 310 people, of which we do not even know the percentage actually was that ended up being infected.

• Wort.lu 
• Tageblatt

• The primary source of the screenshots is not Cybel Inc. The source is a TOR Website where (presumably) "REvil" is publishing notices to companies that don't pay their ransom, the Cactus Group is one of them. 
• There are more screenshots and details that journalists would discover if they would track down the source website.  In particular, a few datasets that beg the question of why they were highlighted in the first place.

• Ransomware Gangs Now Outing Victim Businesses That Don’t Pay Up
• https://www.kpn.com/security-blogs/tracking-revil.htm

Safety
The state of being protected from danger or harm. The condition of being protected from or unlikely to cause danger, risk, or injury. 

Security
protection of a person, building, organization, or country against threats such as crime or attacks by foreign countries:

• Goal of a tracing application : Safety of Individuals and Society
• Means to get there: Security and Privacy controls and mechanism are used to guarantee (to some degree) the  Privacy and Security of the unterlying data
• Allowing for  : Safety through actions taken by analysing the data.

• Luxembourg - 46 Pages, 121 articles, 22 Articles are (partially) about fundamental rights of the people. (http://legilux.public.lu/eli/etat/leg/recueil/constitution/20191214)
• Germany - 146 articles, 19 articles on Fundamental rights of its people.
  https://www.gesetze-im-internet.de/gg/BJNR000010949.html
• France - http://www.assemblee-nationale.fr/connaissance/constitution_01-2015.pdf
• US Consitution Bill of Rights - 2 Pages
  https://en.wikipedia.org/wiki/Constitution_of_the_United_States
  https://nccs.net/blogs/americas-founding-documents/bill-of-rights-amendments-1-10

A list of gaps

• Contrary to for example Germany, the constitution says nothing about Human Dignity and the state's obligation to protect it. That's actually the first article from the German Constitution. "(1) Die Würde des Menschen ist unantastbar. Sie zu achten und zu schützen ist Verpflichtung aller staatlichen Gewalt." 
  In that context, I'd like to point out and emphasize that the constitution however explicitly guarantees that the state will protect the environment (nature) and the promotion of the well-being of animals. (Art11 bis).
• The Luxembourgish Constitution makes no reference to guarantee the fundamental rights of defense. All Luxembourg case-law on procedural and defense rights are based on Article 6 ECHR and does not rely on the Constitution, which does not expressly contain such rights.
• The Luxembourg Constitution has not explicitly provided any constitutional body to protect fundamental rights. 
• The Luxemburgish Constitution with regards to fundamental rights (Chap 2) is often arbitrary in the sense that for the most part it refers to laws that should at a later stage determine the details of those rights. Contrary to for example the constitution of Germany, there is a clear lack of directly deterministic language. Not using a deterministic language guarantees flexibility for the government to change adapt these (through law) at the expense of clarity and  rigidity. It also however is in direct contradiction of the right guaranteed in Art. 11.
  
  
  Let's expand on that; the constitution acknowledges the  "droit naturel humain" as fundamental right in Art. 11.
  
  
  Simply put the "natural human right" are rights that you own because you are human. 
  The "Droit Naturel Humain" seeks to establish a standard that is immune to the fluctuations of history and morals and avoids the arbitrariness of human judgment. 
  
  
  However, the section on fundamental rights within the Luxemburgish constitution seemingly contradicts the very intent of this concept by introducing relative statements all across it's section of fundamental rights ("as determined by law").
  
  
  Natural law is actually opposed to positive law, which is the law in force, enacted by society or the State, which by definition is changeable, according to places and times.
  
  
  Fundamental rights hence should be clearly and deterministically formulated as far as possible, but they often are not and deliberately weak and hollow :
  
  
  Examples :L’Etat garantit la protection de la vie privée, sauf les exceptions fixées par la loi La liberté du commerce et de l’industrie, l’exercice de la profession libérale et du travail agricole sont garantis, sauf les restrictions à établir par la loi.»
  
  La liberté individuelle est garantie. - Nul ne peut être poursuivi que dans les cas prévus par la loi et dans la forme qu’elle prescrit. - Nul ne peut être arrêté ou placé que dans les cas prévus par la loi et dans la forme qu’elle prescrit.

Are they really gaps?

• If it's the case that these take precedence, then I see no reason to not just simply add them to the revision of the constitution, making it both more accessible and understandable for an average citizen (.i.e. me).
• Personally I find it quite frightening that an average citizen is supposed to read, understand and cross-reference existing jurisprudence (or nonexisting for that matter - we have many articles with zero existing case law..) , international treaties, chartas for them to understand their fundamental rights as a citizen of Luxembourg. A constitution and a list of fundamental rights shall be easy to understand and easy to comprehend by it's people.

About the non deterministic nature 

«Art. 25. La Constitution garantit le droit de s’assembler paisiblement et sans armes, dans le respect des lois qui règlent l’exercice de ce droit, sans pouvoir le soumettre à une autorisation préalable. - Cette disposition ne s’applique pas aux rassemblements en plein air, politiques, religieux ou autres; ces rassemblements restent entièrement soumis aux lois et règlements de police.»

"ART. 25. The Constitution guarantees the right to assemble peacefully and unarmed, in accordance with the laws regulating the exercise of this right, without being able to subject it to prior authorization. - This provision does not apply to open-air, political, religious or other gatherings; such gatherings remain entirely subject to the laws and police regulations."

Let's take a look at Art 8 of the German Constitution describing what is basically the same fundamental right.

Art. 8 GG : "(1) Alle Deutschen haben das Recht, sich ohne Anmeldung oder Erlaubnis friedlich und ohne Waffen zu versammeln. (2) Für Versammlungen unter freiem Himmel kann dieses Recht durch Gesetz oder auf Grund eines Gesetzes beschränkt werden.

Translation :

(1) All Germans have the right to assemble peacefully and without weapons without registration or permission.(2) For assemblies in the open air, this right may be restricted by law or by virtue of a statute.

Apart from being short and to the point; the German constitution allows for restrictions by law without stating that the constitution effectively already restricts them, Germany has not included  restrictions in the constitution even what they are. 

Changes I'd like to see

• Take Chapter 2 (Fundamental Rights) and transform it into deterministic statements actually applying Art11 ("Natural Human Law") as much as possible. i.e "Your right is XYZ", instead of: "Your right on topic X will be determined within a law and is not ..". Those articles in essence just state that there must be a law, not the intent or limits such laws would have. If I was able to convey my logic to my reader you will understand that all I am really asking for is applying Art.11 of the constitution "Droit naturel Humain".
• Fundamental rights also serve the purpose to protect from arbritary decisions by governments. we should stay away from mechanisms allowing governments to change the fundamental rights the constitution by way of backdooring it with "will be determined within the law".
  
  Granted, yes there are other procedures with checks and balances within the legislative process and yes sometimes it is necessary to say that, but that's should be the exception not the norm. That said, a fundamental right is fundamental and only allowed to be circumsized within limits. These limits could be described. 
• Involve citizens more into the revision process 

If you master German I recommend to read "Grundrechte im Großherzogtum Luxemburg"

Final Word

I leave you with the following - which I think is relevant and applicable to the current situation  :

Updates

• 26.03.2020: Added Spread and Containment Simulator
• 27.03.2020: Added tested and proven 3D Prints; Added further national dashboards. Fixed the estimated percentages of asymptomatic infections. Clarified terminology (Symptomatic, Asymptomatic, Infected, Ill). Added "From the horse's mouth" section - on the ground reports.
• 29.03.2020 : Added details on why the mortality rate is so different from country to country. In Section Statistics.
• 30.03.2020 : Added Ventilator Pumps Open source designs and information on Disinfecting 3D Prints in the section "What can I do ?" Added interview with Professor Kim Woo-joo from Korea University Guro Hospital in "Videos to watch".
• 31.03.2020 : Added statistics showing the daily number of cases instead of a logarytmic/cumulative approach in statistics. If you want to see these for your country head over to this dashboard: https://nssac.bii.virginia.edu/covid-19/dashboard/
• 01.04.2020 : Added COVID-Trends (Thanks to @memgrinder) and CoronaVirus Forecast (Thanks to @GunstickULM) in Statistics.
• 25.04.2020 : Added Graphs based on the projections of the UNI.LU For Luxembourg

Terminlogy

• SARS-CoV-2 is the name of the particular Coronavirus strain we are seeing now.
• COVID-19 is the respiratory disease caused by the virus NOT the name of the virus
• "Infected" = Infected with the virus (Could be symptomatic OR unsymptomatic)
• "Sick" or "ill" = Infected and suffering from COVID-19 (Symptomatic)
• Infected does not equal Sick (Symptomatic) 
• Depending on the "study" the percentage of the infected that experience no symptoms (.i.e. no COVID-19) is 51%, 69% or 81% (Source: https://www.rki.de/DE/Content/InfAZ/N/Neuartiges_Coronavirus/Steckbrief.html#doc13776792bodyText6). Thanks to Marc Didier for the headsup.  

• Why do case fatality rate (CFR) for COVID19 differ so much between countries? : Source : Dr. Emma Hodcroft : https://threadreaderapp.com/thread/1243870730716094464.html
• Examples :
• Italy tests for coronavirus on deceased
• Terminally ill cancer patient that died and had the presence of the virus accounted as being a victim of SARS-COV2 (Patient #35 - Germany - Source: Prof. Sucharit Bhakdi  https://www.youtube.com/watch?v=JBB9bA-gXL4)

Some countries and/or Media only publish cumulative Dashboards. Below you'll find Germany and Luxembourg (both opting for enforced social distancing) - you see indicators that the initiatives work, a flattening of the curve.

Projections for Luxembourg

Source : Ben Nelson (https://benelsen.com/covid19/unilu.html) and UNI.LU

Simulation based on Luxembourg continuing the lockdown
“(...) midterm projections for Luxembourg predicting the number of assumed positive Covid-19 cases, ICU demands and deaths cases for a continued Lockdown. The projections are obtained by a stochastic agent based epidemiological model and gives for each average value also a 90% confidence interval.”

Simulation based on Luxembourg stopping the lockdown on May 4th

“(...) midterm projections for Luxembourg predicting the number of assumed positive Covid-19 cases, ICU demands and deaths cases for a scenario of a general exit on May 4th. The projections are obtained by a stochastic agent based epidemiological model and gives for each average value also a 90% confidence interval.”

Simulation based on Luxembourg stopping the lockdown  with Backtracing

“(...) midterm projections for Luxembourg predicting the number of assumed positive Covid-19 cases, ICU demands and deaths cases for a scenario of a release of 63k workers on April 20th with initial testing or 25% effective backtracking. The projections are obtained by a stochastic agent based epidemiological model and gives for each average value also a 90% confidence interval.”

Dashboards 

• Europe / WHO
  https://who.maps.arcgis.com/apps/opsdashboard/index.html#/ead3c6475654481ca51c248d52ab9c61
• Worldwide:
  https://nssac.bii.virginia.edu/covid-19/dashboard/
• Worldwide:
  https://www.worldometers.info/coronavirus/#countries
• Worldwide:
  https://gisanddata.maps.arcgis.com/apps/opsdashboard/index.html#/bda7594740fd40299423467b48e9ecf6
• Austria :
  https://info.gesundheitsministerium.at/
• Germany :
  https://experience.arcgis.com/experience/478220a4c454480e823b17327b2bf1d4
• France : 

Simulators 

• Containement Simulator : http://gabgoh.github.io/COVID/index.html
  Simulate containment and infection spread
• Covid-19 Forecast : http://phico.io/coronavirus/charts/
  Compare Trend per country
• Covid-19 Trends : https://aatishb.com/covidtrends/
  New confirmed cases of COVID-19 in the past week vs. the total confirmed cases to date. When plotted in this way, exponential growth is represented as a straight line that slopes upwards

3D Prints / "What can I do ?"

• Open Source ventilator designs:
  1. https://freebreathing.org/
  2. https://e-vent.mit.edu/ 
• Dive Masks Adapters :
  https://www.prusaprinters.org/prints/27214-decathlon-face-mask-adapters
• Faceshields :
  https://docs.library.ucla.edu/plugins/servlet/mobile?contentId=215259556#content/view/215259556
• Disinfecting PLA (or other materials) within isopropanol poses no problem for the prints: https://www.youtube.com/watch?v=txrXX0CQHhU

From the Horses Mouth

• NY - 25/03 : https://www.youtube.com/watch?v=bE68xVXf8Kw
  An emergency room doctor in Elmhurst, Queens, gives a rare look inside a hospital at the center of the coronavirus pandemic. “We don’t have the tools that we need.”

Common Symptoms

• Fever
• Cough and Respiratory Difficulties
• Loosing smell or taste <-

Disinfectant DYI:

• 4 Parts Rubbing Alcohol (Isopropanol) 
• 1 Part Water
• 1 Part Citric Acid (smell)

The above kills virii and is nothing else then what is in commercially available disinfectants.

Videos to watch 

• English / Korean
• Professor Kim Woo-joo from Korea University Guro Hospital
  https://www.youtube.com/watch?v=gAk7aX5hksU 
• German : 
• Prof. Sucharit Bhakdi
  1. https://www.youtube.com/watch?v=LsExPrHCHbw
  2. https://www.youtube.com/watch?v=JBB9bA-gXL4
  3. https://www.youtube.com/watch?v=MARVdS-pHdQ

Picture of the SD Card Locker

History

• Redesigned the laser-cut case to be thinner, making the "laser-cut case" locker version less bulky. It's also now transparent, except for the middle layer which is transparent orange.
• Added usage instructions on the bottom of the PCB. 
• Added a MicroSD slot on the bottom - it allows you to plug a MicroSD card in directly, without using any adapters. 
• Reinforced the MicroUSB port soldering 

• Make read-only Raspberry Pi SD cards
• Make virus-resistant LiveCDs (or, rather, LiveSDs) for all your computer maintenance needs
• Distribute SD cards with promotional materials
• Forensic research and data recovery (reading from the SD card while preventing all write operations)
• Test your SD-card-powered products for unexpected behavior (an SD card becoming read-only is a popular failure mode and tends to happen when the card controller detects severe data corruption).

Feature Set of the SD Card Locker

How does it work?

1. not all readers support it 
2. the OS can choose to ignore it 
3. it's not available on  MicroSD cards 
4. the switch tends to slide accidentally (or fall out of the SD card altogether) when you have no intention of enabling write protection.

How to order ? 

Hints

• Look into zRAM (Virtual Swap Compressed in RAM,) to move your swap into RAM Memory, this way you can still swap effectively and even use RAM more efficiently.
• Use fstab to create directories (Like /etc/log) that only exist in RAM

• [TZO-001-2020] - AVIRA Generic Bypass (ISO)
• [TZO-002-2020] - Kaspersky Generic Bypass (ZIP)
• [TZO-003-2020] - ESET Generic Bypass (ZIP) - CVE-2020-9264
• [TZO-004-2020] - Bitdefender Generic Archive Bypass (GZ2)
• [TZO-005-2020] - Kaspersky Generic Bypass II (ZIP)
• [TZO-007-2020] - Bitdefender Generic Archive Bypass (ZIP)
• [TZO-008-2020] - Bitdefender Generic Archive Bypass (ZIP II)
• [TZO-009-2020] - Bitdefender Generic Archive Bypass (RAR I)
• [TZO-010-2020] - Bitdefender Generic Archive Bypass (RAR II)
• [TZO-011-2020] - ESET Generic Bypass (GZIP) - CVE-2020-10180
• [TZO-012-2020] - ESET Generic Bypass (RAR)
• [TZO-013-2020] - AVIRA Generic AV Bypass (ZIP GPFLAG) -  No Patch 
• [TZO-015-2020] - F-SECURE Generic Malformed Container bypass (RAR)
• [TZO-016-2020] - F-SECURE Generic Malformed Container bypass (GZIP) - CVE-2020-9342
• [TZO-017-2020] - Kaspersky Generic Archive Bypass (ZIP FLNMLEN) 
• [TZO-018-2020] - Bitdefender Malformed Archive bypass (GZIP)
• [TZO-019-2020] - AVIRA Generic AV Bypass (ISO Container) - CVE-2020-9320
• [TZO-020-2020] - Quickheal Generic AV Bypass (ZIP GPFLAG) - CVE-2020-9362
• [TZO-021-2020] - Sophos Generic AV Bypass (ZIP GPFLAG) -  CVE-2020-9363
• [TZO-023-2020] - AVAST Generic AV bypass (ZIP) - CVE-2020-9399

10 years ago I took a look at ways to evade AV/DLP Engine detection by using various techniques and released a metric ton of Advisories. 10 years later after multiple CISO type roles, I wanted to deep dive again and see how far (or not) the AV  industry has reacted to this class of vulnerabilities. [1,2]

Changes

TLS/SSL Audit 0.9

Yahoo! - "Wish list"

Yahoo! announced that it will open up email accounts that are inactive since over a year for registration to anyone that applies. Yahoo! is explaining this as a service to give everyone the chance to an Yahoo ID of their choice.

It is not a Question of "IF"

A story from the Past

Changes

• Added Windows 8 support
• Added Windows Server 2012 support
• Resolved an issue around P521 additions

About Harden SSL/TLS 

• Binary Instrumentation for Exploit Analysis Purposes (part 1)
• Binary Instrumentation for Exploit Analysis Purposes (part 2)
  Using the PIN instrumentalisation framework to analyse exploits
• Randomly failed! Weaknesses in Java Pseudo Random Number Generators (PRNGs)
• FBI Secretly Spying on Cloud Computer Users FISMA/PATRIOTACT - "National Security Letters"
• New collision attacks on SHA-1 - based on optimal joint local-collision analysis [PDF]
• Port scanning /0 using insecure embedded devices
  How a group of poeple compromised thousand of devices and then used them to scan the whole internet. Beware : Ethical boundaries scratched
• "APT PDFs and metadata extraction"
• Research Data to Help Understand the ROI of Your Security Investments - Cloud Computing
  Let's say we welcome the attempt to get us data...
• Two new attacks on SSL decrypt authentication cookies | Ars Technica 

Food for thought 

Changes

SSL Audit v.08

Download

Quick Facts

• Date : 29-30 Novembre 
• Location: Leuven (Belgium)
• Price : Free
• Places : Limited (First registered, First serve)
• Register here
• Conference Schedule
• Training Schedule

Agenda

The agenda is a sound mix between Application Security, Forensics,  Risk Management and represents the current security landscape at large rather well: Building security into Applications in Enterprises, Managing Application Level Vulnerabilities, Source code review on a large scale. It also has 2 innovative talks on exploit mitigation and sandboxing javascript. 

• Browser Security - John Wilander
• Sandboxing Javascript -  Lieven Desmet
• Body Armor for Binaries - Asia Slowinska 
• Forensics - Marc Hullegie and Kees Mastwijk 
• Streamlining Application Vulnerability Management: Communication Between Development and Security Teams  - Dan Cornell 
• Code review for Large Companies - Ruediger Bachmann
• Making Security Invisible by Becoming the Developer’s Best Friends - Dinis Cruz
• OWASP Top 10 vs Drupal - Erwin Geirnaert
• Panel Discussion about the legal aspects of penetration testing

Description

The  primary goal of BTcrack is to crack/recover the PIN and reconstruct the link-key from a previously captured Bluetooth pairing exchange. Together with Eric Sesterhen I released an open-source version of BTcrack in 2006 which since then is part of the tools included in Backtrack. You will find more information on BTCrack  and a POC video here.

Publications

• In a blink of an eye - there goes your AES Key
  Advances in extracting keying material from Hardware (FPGA)
• Visualising Botnets
• Why allowing active ipv6 stacks on your network is a bad idea (but we don't route ipv6)
• A bad couple of years for the cryptographic token industry - must read
  Ouch, the biggest names included. TLDR; Don't use PKCS#1v1.5 padding for RSA and use authenticated encryption.
• Ron was wrong, Whit is right – Weak keys in the internet

Tools

• List of Volatility Plugins
  Leading the Open-source memory analysis field (Forensic, IR, exploit dev)
• IDA Toolbag
  Excellent new set of tools for IDA PRO
• Inception
  Upto-date Firewire Toolchain to dumping memory over the firewire interface. This allows also to unlock locked workstations as Firewire, per design, allows full access to memory over DMA.
• Cryptshark
  .NET library using  Blowfish, BCrypt, SCrypt, and PBKDF2 for any HMAC - following my blog post on how to store password securely, if your into .NET give it a look.

Flame

• Bitdefender Analysis of Flame (3rd update)
  Apart from the interesting information this post includes what appears to be a complete list of  IOCs (Indicator of compromise) for this variant of FLAME.
• The link between Stuxnet and Flame (Bitdefender)
• Kasperkys take on the link between Stuxnet and Flame
• FLAME – The Story of Leaked Data Carried by Human Vector - must read
  How FLAME used the human factor (inc. USB) to bridge the air-gap between networks.

News

• Humanity escapes the solar system