-= [ AlligatorCon Europe 2016] =-

If you have received this invitation by official means, you are welcome to the 2016 edition of AlligatorCon Europe. If you’ve been here last year, you know the drill – friendly hackers, free booze, no-nonsense technical talks and partying at night in Kraków, the Best City in the World ™. If you’re new, welcome to the mayhem and insanity of the Alligator!

[--- Different date, different venue, same shit

Because it’s well within the hacker ethos to fix what ain’t broke, we changed both the dates and the venue for this year. It will also be very important for you to join the mailing list if you haven’t already, to keep up with our unpredictable mood swings once we hit full-on party mode and get lost in the streets of Stare Miasto, blabbing incoherently something about shellcodes, ROP chains and rootkits to bewildered strangers and tourists. What won’t change, of course, are the rules: * You can present using your Twitter name, IRC handle, your identity in F Society, childhood nickname, crossdressing femme name, whatever the hell you want but never with your real name. * No cameras unless explicitly allowed by everyone in the picture. * You must solemnly pledge allegiance to the Alligator and swear under oath you’re up to no good. * Dress code: no one is allowed to wear Crocs within a radius of 100m from the venue. * If you’re up on stage, you have to drink a shot of malinowka (raspberry vodka). No exceptions unless you bring a medical receipt saying you can’t drink because your liver is already fucked. * The contents or even the title of some talks may not be public, on request of the speaker. Loose lips sink ships (and get you k-lined from future editions of the conference).

[--- Why Kraków?

https://www.youtube.com/watch?v=OAhyMqIJCoA Enough said.

[--- Evaluation

The evaluation committee of AlligatorCon is interested in technical topics about hacking, pentesting, exploitation, pwnage, 0days, phreaking, rootkits, radio, satellites, evading censorship, staying free and surviving under the PiS regime, giving the middle finger to The Man and all-round general mischief. Presentations with live demos are strongly preferred. If you fail to produce an interesting topic, bribing the organizing committee members is also acceptable (alcohol, weed and Bitcoin preferred). Claiming to have CEH, CISSP, CREST or similar certifications is cause for public shaming, and the perpetrator will be forced to wear a purple letter “C” on their clothes -- also, expect being booed and don’t be surprised if empty bottles fly your way. Anyone trying to push a talk about enterprise security policies, antivirus, aiding law enforcement and intelligence agencies or anyone using the word "cyberwar" will be considered fair game for scientific experiments (mainly involving explosives and Sarin gas).

[--- Schedule

[--- Talks

Title: Heliradare Speaker: Pedro Country of origin: Spain (Content may not be published. You'll have to come here to find out!) [--- Title: Some cool ELF shit & some other cheap ELF shittery to break some shit Speaker: nitr0us Country of origin: Mexico Basically I'd like to show some cool things I've seen while playing with ELFs. For example: - ELF + crypto - PKI in ELF execs (digitally signed, etc.) - Some recent ELF VXs and their infection techn1quez as well as some cheap tricks to protect your binaries against infection - Recent programs to identify malicious stuff in ELFs - Some anti-debugging techn1quez aka "let's corrupt our ELFs and crash the debuggers" - ELF file format fuzzing and how I found and analyzed the latest OpenBSD kernel panic() [1] - Some other cool shit I don't remember right now [1] https://www.exploit-db.com/exploits/36799/ [--- Title: Guerrilla Tor Speaker: b0rh / critter Country of origin: Spain / Argentina aka Uboatland (Content may not be published. You'll have to come here to find out!) [--- Title: Using SMT solvers, concolic execution, second-order logic and knot theory to identify bugs in software a.k.a polish fuzzy lop. Speakers: shm as akat1, s1m0n and n1x0n Country of origin: Poland aka Kaczynskiland ...nah that was just a bad joke, we all know that this shitty scientific stuff does not work, instead of that we're going to present a new hammer in town. Last year, we announced to release one of our fuzzers, it's high time to do it. We're going to talk about concept behind this stuff, its guts and how to use it to find useless bugs in OpenSSL or libc in minutes (or hours). <marketing>If you want to impress your family/employer/friends by identifying 0days in libshit, don't miss this talk.</marketing> [--- Title: Hello Quark! Fitbit firmware reversing (Lessons learned) Speaker: dsrc Country of origin: Brazil aka HuehuEland Fitbit Flex is an activity tracker device created by fitbit.com that essentially tracks users' body activity by reading sensors data from a wristband. All data collected by the Fitbit tracker is processed, encrypted and sent to a remote server, leaving the user with no access to the raw data. This talk aims to provide a walk-through over the Fitbit Flex architecture, its protocol and firmware. Tools and methodology utilized to obtain access to the firmware as well as reverse it will be presented and discussed during the talk. [--- Title: What bug is this in my house? Speaker: ovid Country of origin: Brazil aka HuEhuEland This presentation will show a practical application of Deep Neural Networks to classify Malwares. We will present results of classification over two different perspectives: - by using static data: which can be useful for evaluating the effectiveness of this technique applied as engines for AVs); - by using dynamic data: which can be used as starting step for collecting in-depth information about criminal groups (targets, distribution mechanisms and infra-structure). Experiments were carried out with 1.000 Malware samples (collected in February and March 2016) from the 6 most popular families. [--- Title: Reversing education Speaker: ciphersheep Country of origin: The Netherlands This talk gives a comical overview of the current state of security education in a country not to be named, providing a walkthrough of various problems. Some of the problems we will cover are the rise of "cyber", the revenge of the CISSP, and the fact that lecturing about the CIA triad followed by multiple-choice exams is cheaper than in-depth technical coverage. How do we turn this tide? How to we teach students the hacker mindset instead of pouring useless ISO 27001 facts into their skulls? We will present tentative answers to these questions, based on experimental courses given at a university of applied science. Among other things, we will illustrate the need for a bottom-up instead of a top-down approach to curriculum development, as the latter only leads to more CISSPs. [--- Title: I see London, I see France, I see a Virtual Machine's underpants! Speaker: @buherator Country of origin: Hungary aka Goulashland Virtual Machine Introspection (VMI) is a technique to inspect the execution of virtualized hosts from the level of the hypervisor[1]. This way the guest operating systems and their applications generally won't have a clue that creepy eyes are watching them that provides some interesting opportunities[2]. This talk will give a high level overview on VMI and will show how this technique was utilized in offensive research after repurposing a nice neighbors defensive tool. Tips and tricks will be presented to give the audience a head-start for developing new tools and avoiding #FAILs. [1] http://wiki.xenproject.org/wiki/Virtual_Machine_Introspection [2] https://www.youtube.com/watch?v=ms-jT4s98No [--- Title: Lightning Talks Speaker: .* Country of origin: .* A slot will be reserved for lightning talks. Just get up on stage and talk about whatever you want. Worst that can happen we throw pierogi at you.

[--- Extracurricular activities

As usual, we always propose controversial capture the flags but we haven’t done so in our European version yet. So here’s the deal: extra points for whoever pwn a few Radio Maryia-listening Catholic freaks ahead of World Youth Day, steal their Snapchat nudes and tweet them to @pontifex just for teh lulz.

[--- Location

Attendees will have to show up at the following GPS location (N 50° 2' 41.859'' - E 19° 57' 17.798'') carrying a piece of paper with the following token printed on it: VHJhcmVueSBYcnZndSBOeXJrbmFxcmUgcm5nIGxiaGUgdXJuZWcgYmhn An agent will contact you with further instructions. Alternatively, you can drop us an email. But that's just lame.

[--- Organizing Committee

* Kurwa Małpka & Count Crapula * Mr. Robot * Edward Snowden * Acid Burn * Tinky-Winky from The Teletubbies Special thanks to the folks from HackerStrip for designing our poster:

[--- Sponsors

This event is proudly sponsored by Komisariat @ Plac Nowy, roksa.pl, Juice Rap News, the Bernie Sanders campaign team, Scorpion Team from the NSA, Vladimir Putin and his Dancing Gay Musical Broadway Show Troupe, and the Official Facebook Page of Mikolaj, the iconic old dude of Kazimierz [*]. [*] https://www.facebook.com/Miko%C5%82aj-z-krakowskiego-Kazimierza-271132896293527/?fref=ts