Bsides PDX 2017 Workshops

Security analytics can be a difficult and expensive, but it doesn't have to beYour automated defenses will fail. Attackers will gain access to your network by exploiting software, or even your people. In order to deal with this reality organizations need to assume they have been breached and work backwards from there. But, how can you find adversaries in your infrastructure? Threat hunting is the practice of proactively seeking out evil in your network, finding needles in haystacks that link to other needles and unveiling how an organization was compromised and possibly even answering the “why?”. In this hands-on threat hunting workshop participants will go on a guided threat hunting expedition, pivoting across various data sources (threat intelligence, DNS, endpoint, web logs, email) to reveal a campaign targeting an organization. Participants will walk away with a basic understanding of threat hunting and the tools needed to develop a hunting practice in their own organization.

All the cool kids are fuzzing these days. With efficient and simple to use fuzzers like AFL and a sound corpus just a Bing search away, why not get in the game? You’ll keep your apartment heated and you might even cash in on that sweet sweet WinRar bug bounty! But what if your sights are set a bit higher; you dream of a luxurious Master of Pwns cigar jacket or some of that NSA 0day money? This workshop will not be handing out free 0day, but will show you how to get started fuzzing browsers and the pitfalls to avoid. Students should come prepared with a laptop (at least an i5 processor recommended) and VMware player or equivalent.

Anyone that has run a server on the Internet for any length of time quickly learns that the Internet is full of spammers, bots, and other characters you would prefer didn’t exist. One way to keep them at bay is to use blacklists with IPTables. In this talk we’ll look at several sources of blacklists and how to efficiently incorporate blacklists into Linux IPTables to effectively mass block IP addresses and protect systems.