TOP SECRET//SI//REL USA, FVEY National Security Agency/Central Security Service Information Paper 0x4153454e4f4c4f50 Alligator Europe Security Conference 2016 17 & 18 June @ Areszt śledczy - Kraków, Poland aka Kaczynskiland


-= [ AlligatorCon Europe 2016] =-
If you have received this invitation by official means, you are invited to the 2016 edition of AlligatorCon Europe. If you’ve been here last year, you know the drill – friendly hackers, free booze, no-nonsense technical talks and partying at night in Kraków, the Best City in the World ™. If you’re new, welcome to the mayhem and insanity of the Alligator!
[--- Different date, different venue, same shit
Because it’s well within the hacker ethos to fix what ain’t broke, we changed both the dates and the venue for this year. It will also be very important for you to join the mailing list if you haven’t already, to keep up with our unpredictable mood swings once we hit full-on party mode and get lost in the streets of Stare Miasto, blabbing incoherently something about shellcodes, ROP chains and rootkits to bewildered strangers and tourists. What won’t change, of course, are the rules: * You can present using your Twitter name, IRC handle, your identity in F Society, childhood nickname, crossdressing femme name, whatever the hell you want but never with your real name. * No cameras unless explicitly allowed by everyone in the picture. * You must solemnly pledge allegiance to the Alligator and swear under oath you’re up to no good. * Dress code: no one is allowed to wear Crocs within a radius of 100m from the venue. * If you’re up on stage, you have to drink a shot of malinowka (cherry vodka). No exceptions unless you bring a medical receipt saying you can’t drink because your liver is already fucked. * The contents or even the title of some talks may not be public, on request of the speaker. Loose lips sink ships (and get you k-lined from future editions of the conference).
[--- Why Kraków?
[--- Schedule

/** @type DAY-1 */

10:00 >
Title: Heliradare
Speaker: Pedro
Country of origin: Spain


11:00 >
Title: Some cool ELF shit & some other cheap ELF shittery to break some shit
Speaker: nitr0us
Country of origin: Mexico


12:00 >
Title: Guerrilla Tor
Speaker: b0rh / critter
Country of origin: Spain / Argentina aka Uboatland


13:00 >
LUNCH BREAK


14:00 >
Title: Surprise talk!
Speakers: ?
Country of origin: ?


15:00 >
Title: Using SMT solvers, concolic execution, second-order logic and knot theory to identify bugs in software a.k.a polish fuzzy lop.
Speakers: shm as akat1, s1m0n and n1x0n
Country of origin: Poland aka Kaczynskiland


16:00 >
BOOZE / WEED BREAK


17:00 >
END OF DAY 1



/** @type DAY-2 */

10:00 >
HANGOVER BREAK


11:00 >
Title: Hello Quark! Fitbit firmware reversing (Lessons learned)
Speaker: dsrc
Country of origin: Brazil aka HuehuEland


12:00 >
Title: What bug is this in my house?
Speaker: ovid
Country of origin: Brazil aka HuEhuEland


13:00 >
LUNCH BREAK


14:00 >
Title: Reversing education
Speaker: ciphersheep
Country of origin: The Netherlands


15:00 >
Title: I see London, I see France, I see a Virtual Machine's underpants!
Speaker: @buherator
Country of origin: Hungary aka Goulashland


16:00 >
Title: Lightning Talks
Speaker: .*
Country of origin: .*


17:00 >
BOOZE / WEED BREAK


18:00 >
END OF DAY 2


[--- Talks
Title: Heliradare Speaker: Pedro Country of origin: Spain (Content may not be published. You'll have to come here to find out!) [--- Title: Some cool ELF shit & some other cheap ELF shittery to break some shit Speaker: nitr0us Country of origin: Mexico Basically I'd like to show some cool things I've seen while playing with ELFs. For example: - ELF + crypto - PKI in ELF execs (digitally signed, etc.) - Some recent ELF VXs and their infection techn1quez as well as some cheap tricks to protect your binaries against infection - Recent programs to identify malicious stuff in ELFs - Some anti-debugging techn1quez aka "let's corrupt our ELFs and crash the debuggers" - ELF file format fuzzing and how I found and analyzed the latest OpenBSD kernel panic() [1] - Some other cool shit I don't remember right now [1] https://www.exploit-db.com/exploits/36799/ [--- Title: Guerrilla Tor Speaker: b0rh / critter Country of origin: Spain / Argentina aka Uboatland (Content may not be published. You'll have to come here to find out!) [--- Title: Using SMT solvers, concolic execution, second-order logic and knot theory to identify bugs in software a.k.a polish fuzzy lop. Speakers: shm as akat1, s1m0n and n1x0n Country of origin: Poland aka Kaczynskiland ...nah that was just a bad joke, we all know that this shitty scientific stuff does not work, instead of that we're going to present a new hammer in town. Last year, we announced to release one of our fuzzers, it's high time to do it. We're going to talk about concept behind this stuff, its guts and how to use it to find useless bugs in OpenSSL or libc in minutes (or hours). <marketing>If you want to impress your family/employer/friends by identifying 0days in libshit, don't miss this talk.</marketing> [--- Title: Hello Quark! Fitbit firmware reversing (Lessons learned) Speaker: dsrc Country of origin: Brazil aka HuehuEland Fitbit Flex is an activity tracker device created by fitbit.com that essentially tracks users' body activity by reading sensors data from a wristband. All data collected by the Fitbit tracker is processed, encrypted and sent to a remote server, leaving the user with no access to the raw data. This talk aims to provide a walk-through over the Fitbit Flex architecture, its protocol and firmware. Tools and methodology utilized to obtain access to the firmware as well as reverse it will be presented and discussed during the talk. [--- Title: What bug is this in my house? Speaker: ovid Country of origin: Brazil aka HuEhuEland This presentation will show a practical application of Deep Neural Networks to classify Malwares. We will present results of classification over two different perspectives: - by using static data: which can be useful for evaluating the effectiveness of this technique applied as engines for AVs); - by using dynamic data: which can be used as starting step for collecting in-depth information about criminal groups (targets, distribution mechanisms and infra-structure). Experiments were carried out with 1.000 Malware samples (collected in February and March 2016) from the 6 most popular families. [--- Title: Reversing education Speaker: ciphersheep Country of origin: The Netherlands This talk gives a comical overview of the current state of security education in a country not to be named, providing a walkthrough of various problems. Some of the problems we will cover are the rise of "cyber", the revenge of the CISSP, and the fact that lecturing about the CIA triad followed by multiple-choice exams is cheaper than in-depth technical coverage. How do we turn this tide? How to we teach students the hacker mindset instead of pouring useless ISO 27001 facts into their skulls? We will present tentative answers to these questions, based on experimental courses given at a university of applied science. Among other things, we will illustrate the need for a bottom-up instead of a top-down approach to curriculum development, as the latter only leads to more CISSPs. [--- Title: I see London, I see France, I see a Virtual Machine's underpants! Speaker: @buherator Country of origin: Hungary aka Goulashland Virtual Machine Introspection (VMI) is a technique to inspect the execution of virtualized hosts from the level of the hypervisor[1]. This way the guest operating systems and their applications generally won't have a clue that creepy eyes are watching them that provides some interesting opportunities[2]. This talk will give a high level overview on VMI and will show how this technique was utilized in offensive research after repurposing a nice neighbors defensive tool. Tips and tricks will be presented to give the audience a head-start for developing new tools and avoiding #FAILs. [1] http://wiki.xenproject.org/wiki/Virtual_Machine_Introspection [2] https://www.youtube.com/watch?v=ms-jT4s98No [--- Title: Lightning Talks Speaker: .* Country of origin: .* A slot will be reserved for lightning talks. Just get up on stage and talk about whatever you want. Worst that can happen we throw pierogi at you.
[--- Extracurricular activities
As usual, we always propose controversial capture the flags but we haven’t done so in our European version yet. So here’s the deal: extra points for whoever pwn a few Radio Maryia-listening Catholic freaks ahead of World Youth Day, steal their Snapchat nudes and tweet them to @pontifex just for teh lulz.
[--- Location
Attendees will have to show up at the following GPS location (N 50° 2' 41.859'' - E 19° 57' 17.798'') carrying a piece of paper with the following token printed on it: VHJhcmVueSBYcnZndSBOeXJrbmFxcmUgcm5nIGxiaGUgdXJuZWcgYmhn An agent will contact you with further instructions. Alternatively, you can drop us an email. But that's just lame.
[--- Organizing Committee
* Kurwa Malpka & Crapula * Mr. Robot * Edward Snowden * Acid Burn * Tinky-Winky from The Teletubbies
[--- Sponsors
This event is proudly sponsored by Komisariat @ Plac Nowy, roksa.pl, Juice Rap News, the Bernie Sanders campaign team, Scorpion Team from the NSA, Vladimir Putin and his Dancing Gay Musical Broadway Show Troupe, and the Official Facebook Page of Mikolaj, the iconic old dude of Kazimierz [*]. [*] https://www.facebook.com/Miko%C5%82aj-z-krakowskiego-Kazimierza-271132896293527/?fref=ts
0x41524945555a23 [EOF]