Program Overview

Please note: the program schedule is not final, please keep checking for updates.

• Forensics

  Silvio Oertli (SWITCH)

  Course level: Beginner in IT-Forensics. The Train the Trainer session is Intermediate.

  Intended Audience: People from CSIRTs who might do data seizing or forensic analysis on devices.

  Pre-requisites: Attendees should bring a laptop which can boot a linux from a usb or cd drive.

  Abstract: As a Member of a CSIRT it might be that you will be asked to do forensic analysis on devices. Most of the Time the first step will be a seizure of the device.

  In this training, you will gain a high level basic overview over the field of digital forensics and learn a way to properly acquire data of a device.

  January 23, 2019 09:00-10:30, January 23, 2019 10:45-12:00, January 23, 2019 13:00-15:30, January 23, 2019 15:45-17:00

  part1_intro.pdf

  MD5: 029bf44e384330eb932e0252b2b1fcf5

  Format: application/pdf

  Last Update: February 27th, 2019

  Size: 5.51 Mb

  part2_theory_of_practice.pdf

  MD5: cb5e1e009662500c174e0b33bce61766

  Format: application/pdf

  Last Update: March 4th, 2019

  Size: 18.83 Mb

  part3_memory_forensics.pdf

  MD5: f7301207e107f4f4db0989b9a17cdce0

  Format: application/pdf

  Last Update: March 4th, 2019

  Size: 29.81 Mb

  part4_summary.pdf

  MD5: 172595ec6e24ccc47332a17c30b01fe9

  Format: application/pdf

  Last Update: March 4th, 2019

  Size: 16.49 Mb

• DNS Intel

  Irena Damsky (Damsky Tech)

  Course level: Intermediate

  Intended Audience: Malware analysts, hunters, soc analysts, network analysts, IR handlers and anyone interested in learning how to use DNS to their advantage.

  Pre-requisites: Basic understanding on networking.

  Abstract: DNS is the one of the basic layers that holds the Internet together. Without it, not much else works... even malware. This three-hour presentation is focused on how to use DNS to the advantage of defending networks. With good techniques it is possible to find a great deal of misuse based on DNS such as DGAs, fast/double flux networks, phishing, and brand impersonation. Tools like passive DNS, whois, and active probing allow defenders to proactively search for malicious indicators before they are operationalized so defenders can get ahead of the attack cycle.

  Presenter: Irena Damsky is the founder of Damsky.tech – CTI Research, Training and Consulting. She is a security and intelligence researcher and developer based in Israel. Her focus is on threat intelligence, networking, malware & data analysis and taking out bad guys as she is running the company and provides the different services.

  Prior to starting Damsky.tech, Irena held different roles in the industry from ranging from Threat intelligence leader to VP of Security Research and served over six years in the Israeli Intelligence Forces, where she now holds the rank of Captain in the Reserve Service. She is a frequent speaker at security events, holds a BSc and MSc in Computer Science, and is fluent in English, Russian, and Hebrew.

  Website: https://damsky.tech Twitter: @DamskyIrena LinkedIN: https://www.linkedin.com/in/irenadam/

  January 23, 2019 09:00-10:30, January 23, 2019 10:45-12:00

• Beyond paste monitoring: deep information leak analysis

  Janis Džerins, CERT.LV

  It is a well-known fact in the InfoSec community that paste sites are used to anonymously share information that can be (and is) used for illegal and/or unethical activities on the internet (unauthorized access, hacking, DOXing). Static patterns (character and byte sequences, regular expressions) are quite commonly used for information leak detection. The objective of this presentation is to highlight deficiencies of using such patterns as the sole method of information leak detection, and propose complimentary techniques to increase the usefulness of such applications. We also present a proof-of-concept application where these techniques are being implemented which is being developed in the framework of CEF project "Improving Cyber Security Capacities in Latvia".

  January 21, 2019 15:30-16:00

  2019-tallinn-slides-janis-dzerins.pdf

  MD5: 73cff4e4dacf9690661e997c56180341

  Format: application/pdf

  Last Update: January 31st, 2019

  Size: 789.79 Kb

• CinCan - Codifying your malware analysis workflows

  Kimmo Linnavuo and Erno Kuusela (NCSC-FI)

  CinCan - Codifying your malware analysis workflows - Building shareable, repeatable & history preserving analysis pipelines using your favourite tools + CI + git + containers

  January 22, 2019 15:50-16:05

• Discovering ATT&CK framework network observability with systems that are built with duct tape, sweat, and tears

  Toomas Lepik (TalTech)

  Course level: Basic/Intermediate

  Intended Audience: Hunters, soc analysts, network analysts, IR handlers and monitoring solution architects.

  Pre-requisites: Laptop with WiFi access and vnc , rdp client.

  Abstract: We will take dive to ATT&CK framework showing how to map your own monitoring sytem to understand your capabilities and as example describe S4A with it. Take look,how efficient S4A components Suricata and Moloch are detecting and discovering some of ATT&CK described techniques that are implemented in atomic-red-team. For small mocup office network moloch and suricata are deployed and you are able to see what you can detected and try your own hunts.

  Presenter: Toomas Lepik , Ex CErt-EE form 2007 member of Cert community now Junior research and Lecturer of Network Forensics in Tallin Univeristy of Technology.

  January 23, 2019 13:00-15:30, January 23, 2019 15:45-17:00

• DoH, DoT & ESNI – What it means for malware.

  Graham Stevens, BTCERT/CC

  The talk will give an in-depth view of DNS over HTTPS, DNS over TLS, and the TLS 1.3 draft for Encrypted SNIs. The talk will then discuss how these will affect future investigations/incidents when they are abused by malware and malicious actors. If time is on my side, I will also hope to include some real malware samples that are using these techniques.

  January 22, 2019 13:30-14:00

• Experiences from cyber exercises.

  Franz Lantenhammer, Lauri Luht, and Silver Saks, NATO CCDCOE

  Introducing the annual cyber defence exercises Locked Shields and Crossed Swords the NATO CCDCOE is organising. An overview from the technical perspective as well as introducing other relevant objectives and elements of the exercises.

  January 21, 2019 13:30-14:00

• Exploit Kit Hunting with Cuckoo Sandbox

  Jurriaan Bremer and Ricardo van Zutphen, Cuckoo Sandbox

  Cuckoo Sandbox is the leading open source automated malware analysis system, used by tens of thousands of users including hundreds of international CERT/SOC/IR teams. In this presentation we will take a look at the highlights of our recent developments in Cuckoo Sandbox regarding the automated analysis of in-the-wild exploits & payloads used by Exploit Kits, our capabilities of performing an offline replay of such analyses (allowing one to re-run the analysis over and over again), and our work in progress on performing many URL analyses in parallel. Through this new functionality we aim to simplify obtaining relevant information and IOCs from Exploit Kits, something that up until now has been mostly a manual and complex job.

  We will briefly highlight how organizations can use our new functionality in their own teams. In addition, we will provide demo's based on which both novice and expert users can quickly grasp what's going on, how they could replicate a replay of various known/captured Exploit Kits on their own systems, and high-level information on analyzing tens or hundreds of thousands of URLs per day for the existence of Exploit Kits using Cuckoo Sandbox.

  With a growing team of researchers & developers, Cuckoo Sandbox is becoming more mature by the month. We're always looking to improve it further (feedback from our community helps a lot here!) and are working on a number of novel features that will surely be widely adopted in the CERT community throughout the next years.

  January 22, 2019 11:15-12:00

• Lessons learned in a forensic lab based on real cases

  Michael Hamm (CIRCL)

  Lessons learned in a forensic lab based on real cases.

  January 22, 2019 14:00-14:30

  forensics.pdf

  MD5: 5fb1a532e3f594e38e4b3f78beecebc0

  Format: application/pdf

  Last Update: February 8th, 2019

  Size: 535.6 Kb

• Lightning Talks

  January 21, 2019 16:00-16:50

  WannaCry_wont_die.pdf

  MD5: 676182a08089a425165e7075be22d3cb

  Format: application/pdf

  Last Update: February 1st, 2019

  Size: 970.1 Kb

• Linking cyberespionage groups targeting victims in South Asia

  Daniel Lunghi and Jaromir Horejsi, TrendMicro

  Over the last few years, the security industry has tracked multiple threat actors targeting victims in South Asia. This started in 2013 with the "Hangover" report, and was followed by researches including "Snake in the Grass" in 2014, "Patchwork" and "Confucius" in 2016, "Bahamut" and "EHDevel" in 2017 and "Donot" in 2018. Some of these reports suggest that these attacks originate from India.

  The targets of these different threat actors are high-profile individuals from various mass media, retail, military, aerospace, banking and diplomatic organizations in the Middle East and South Asian region. The modus operandi of these groups, as well as their infrastructure, might seem unrelated at first, but we have been able to notice some connections after further analysis of the malicious documents, malware samples, phishing pages and other tools used by these groups. These connections may include the backend infrastructure, source code sharing, similar encryption keys and algorithms.

  In our research we will present some of these similarities, which let us think that these groups are somehow related, even being part of a larger structure.

  January 22, 2019 15:20-15:50

  Linking_South_Asian_cyber_espionnage_groups-to-publish.pdf

  MD5: 2738bd37411c2f35f8359b72827c4cf4

  Format: application/pdf

  Last Update: January 31st, 2019

  Size: 4.62 Mb

• Mirai: Behind the scenes.

  Joan Soriano, S2 Grupo CERT

  In this talk, is going to be introduced how the speaker joined, for more than six months, the gang behind the most active IoT's botnets around the world. The speaker will show how they work, which are their motivations, and some mistakes done by police and infosec community in malware attribution.

  January 22, 2019 14:50-15:20

• Promoting a global CSIRT Maturity framework for national CSIRTs & a case study of CSIRT Maturity in Japan

  Ichi Komura, NTT and Don Stikvoort, NCSC-NL

  CSIRT maturity and how to assess and improve that is of increasing importance worldwide. SIM3 is the most popular CSIRT maturity model, and has a global footprint. Using SIM3, ENISA has devised an approach that defines 3 stages of increasing maturity, and is applying this together with the 28 national CSIRTs of the European Union. Starting from SIM3 and the ENISA work, we have proposed to the GFCE (Global Forum on Cyber Expertise) to consolidate this to become a globally applicable CSIRT maturity framework, initially aimed at national CSIRTs - but easily adaptable to other kinds of CSIRTs as well. This project aims to deliver tangible results in the course of 2019. A strong cooperation with FIRST, ENISA, Open CSIRT Foundation and other significant players in this area (like ITU, CERT/CC and others) is part of the integral approach. We will explain the goals and how we aim to get there. Your feedback will be invited.

  Japan, where building CSIRTs is booming, serves as excellent case study for the application of SIM3. The number of the Japanese CSIRT community (NCA) members is over 320 and many teams joined the NCA in recent years.

  To improve member teams' maturity is one of the big challenges. The NCA uses SIM3 as a supporting tool to achieve this. Many NCA members are private companies, who don't always have sufficient resources to improve themselves. Such teams are evaluated by applying SIM3 in a different way from communities such as TF-CSIRT and ENISA: the "-1 level" is offered as option for all parameters. This allows the teams to choose which SIM3 parameters are not relevant for them at that moment in time. Also, no minimum requirements of SIM3 are checked initially.

  The SIM3 trial in Japan is explained, and the results are presented. A main finding is that SIM3 incorporates many valuable aspects that can help to improve CSIRTs.

  January 21, 2019 14:00-14:40

• RIPE Atlas: legal, security and ethical aspects of running an IoT network

  Mirjam Kühne and Ivo Dijkhuis, RIPE NCC

  RIPE Atlas is a global active measurement infrastructure, maintained by the RIPE NCC. It is based on the voluntary contributions of thousands of probe hosts worldwide. In essence those RIPE Atlas probes are IoT devices that people place in their homes. We made some conscious ethical considerations in order to protect these probe hosts and we are strictly following certain design and security principles and best current practices. In this presentation we will present the ethical, security and legal aspects that are put in place in order to support and protect this shared responsibility between the RIPE NCC as the provider or the platform and the users.

  January 21, 2019 15:00-15:30

  RIPE-Atlas-IoT-TF-CSIRT-56.pdf

  MD5: 1d4398516d05e798d050b656cba51543

  Format: application/pdf

  Last Update: January 31st, 2019

  Size: 5.6 Mb

• Social Event

  Tallinn Creative Hub (Kultuurikatel) in Cauldron Hall
  Põhja pst 27a, Tallinn, Estonia

  Drinks and light food - networking and entertainment.
  The doors are open from 18.30. Name badges will be required for entrance.

  Please find more information about Caludron hall & Tallinn Creative Hub (Kultuurikatel): https://kultuurikatel.ee/en/ruumid/katelde-saal/

  January 21, 2019 18:30-22:00

• Supporting EU incident response capabilities

  Rossella Mattioli, ENISA

  For more than ten years ENISA has been supporting Member States and CSIRT communities in EU https://www.enisa.europa.eu/csirts-map to build and advance their incident response capabilities with handbooks, online & onsite trainings and dedicated projects. Since the introduction of the NIS Directive, ENISA is focusing on the newly established CSIRTs Network http://www.csirtnetwork.eu/ , the ENISA maturity assessment framework for incident response teams http://enisa.europa.eu/sas-tool , the Reference Security Incident Taxonomy Working group https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force and to tailor existing trainings http://enisa.europa.eu/trainings for specific sectors. The goal is to foster and facilitate operational cooperation and information exchange for stronger incident response in EU. The talk gives an overview of the latest updates on these tools, projects and trainings available for incident response teams.

  January 21, 2019 13:00-13:30

  Supporting-EU-incident-response-capabilities.pdf

  MD5: 8c3c49bb807acd787d02756bea3b70b0

  Format: application/pdf

  Last Update: January 31st, 2019

  Size: 3.61 Mb

• TF-CSIRT meeting & FIRST Regional Symposium Europe
  • Program Overview
  • Registration
  • Location
  • Venue
  • Hotel Information
  • About Tallinn
    • Things to do
    • Traveling to Tallinn
    • Quick Facts