BSides Perth 2021

Building and scaling a security champions program and appsec community with insights from company culture, research about developer motivations and gaining leadership buy-in.

I'll share options to continually improve security awareness and secure code training programs. Also, how to reward and recognise security champions to maintain engagement over time and as vulnerabilities evolve over time.

A look into the role of cryptography in warfare. What ciphers were used, how were they cracked and what were the consequences? And how will we protect our data during future cyber warfare?

Being a rather flexible language, JavaScript gives rise to a variety of ways malicious code can be obscured from analysis. This talk picks apart how the most popular JavaScript obfuscator works, and demonstrates how the tool deobf can automatically undo all of that.

"Criminal enterprises, just like legitimate businesses, have needed to adapt to the changing environment to remain profitable and sustainable. Bex Nitert will present findings from her ongoing research into the operations, supply chain, victimisation, and money trail of a cybercrime actor and their progression from sole trader to criminal enterprise leader. This talk will contain a range of content including the technical and financial aspects of the cybercrime operations, OPSEC fails, investigation techniques, and much beloved war stories."

"Operational technology, that is technology that controls physical processes, is a wily beast. It’s hard to update, expensive to replace, and mission critical for both production ($$$) and safety. So how do you secure it ? 20 years ago, the answer was “isolate it.” And for the most part, we’ve left it at that. But as systems become more reliant on interconnectivity, we need to think harder about the risks that our operational systems face and the controls we need to properly secure them. This talk will walk you through performing risk assessments on operational systems - what to consider, what to be concerned about, and most importantly, how this plays out irl (with names and products changed to protect the guilty, of course). "

"Product Security is becoming increasingly important across Australian business, but the approaches and tooling being used is still quite legacy. Our reliance on expensive static analysis tools, manually running dynamic testing services, and trying to educate developers about the OWASP Top10 just isn't cutting it anymore and largely becoming ineffective, slowing productivity, and frustrating security professionals AND software engineers alike. This talk seeks to highlight the problems Australian enterprises face in the Product Security space, and what we should be investigating or investing in to uplift our ProdSec capability to be in line with GEU / NA peers."

Open-source modules within ecosystems are undoubtedly awesome. However, they also represent an undeniable and massive risk. You’re introducing someone else’s code into your system, often with little or no scrutiny. The wrong package can introduce critical vulnerabilities into your application, exposing your application and your user's data. This talk will use a sample application, Goof, which uses various vulnerable dependencies, which we will exploit as an attacker would. For each issue, we'll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it.

After 20 years of Information Technology and Cyber Security Conferences I have seen the Good, the Bad and the downright Fugly when it comes to talks. This talk will focus on what not to do with some great recollections of past talks and also the best way to set up a talk to walk away from with your reputation in tact.

TDD, dependency injection, DevOps – buzz-words galore! We constantly hear about how these practices improve software maintainability, increase productivity, and reduce time-to-ship. But what if these practices were applied to malicious software development? In this presentation, I walk through my journey building a real-world ransomware payload which was ultimately executed in multiple production networks, as part of a cyber security exercise.

"For decades, anthropologists, quantitative historians, and sociologists have discussed and proposed various explanations for the collapse of civilizations, from unsustainable complexity, decay of social cohesion, rising inequality and general misfortune. Using our time traveling phone booth, we’ll investigate historical collapses and conduct a root cause analysis to investigate why these collapses happened, and how we can observe similar issues in modern business environments. This talk provides an overview of how to identify cultural threats in an rapidly evolving business landscape, and how we can use modern day tools to identify these threats before they result in security culture collapse. Key points addressed - Who is impacting your culture - Identifying cultural problems - Building a diagnostic toolkit"

"Like almost any headline you see in 2021 there is a story behind the story, and this is the story of how major structural shifts in capitalism in the 1980s got SolarWinds breached in 2020. This talk explains dark patterns in financial engineering, the connections between the Gordon Gecko Wall Street of the 1980s and some of the major security beaches of the last 10 years. More importantly we finish with the question: who might be next? "

Application consent allows a third party service to gain persistent access to resources in your environment. This can be something simple like scheduled automation scripts, using a Github account to log into HacktoberFest, or granting access to email and calendar for your fancy smart whiteboard. Recent high profile security incidents have shown how API access have been exploited to be used for persistence. Management of the application consent process, and environment access for registered applications were free and unfettered in many environments, allowing bad guys to do what they wanted in a largely unobserved way. This talk will explain about the application consent process, and why as an application developer you need to ensure you request only the minimum permissions required for your application to work. The talk will explain to those responsible for administration and security of an environment how they can control and manage potential security risks in the environment caused by these allowed applications.

For the past year or so, it seems that ransomware suddenly became the talk of the town. Companies in various industries have been targeted. Hospitals, transportation organisations and food supply chains were not spared. How did we get to this point? What can we do to prepare and protect our organisations? This presentation will cover a brief history of ransomware and how the TTPs of the ransomware gangs have evolved, and what actions can we take to prevent ransomware from further proliferating.

"Building a Security Operations capability from scratch is hard. How many people do you need? What processes should you use? What tools can you implement? Should you go 24/7 or 8/5? This presentation discusses some of the thought processes and key questions that are required in order to develop a successful Security Operations capability, and how you can develop a function that meets the needs of the business, whilst ensuring that stakeholders don't see it as a ""financial sink"" and see the value provided to the business."

Blockchain and smart contract technologies have taken the globe by storm and are rapidly evolving. As businesses begin to use smart contracts, we as cyber security professionals must be aware of the various sorts of attacks that can be carried out and how to best defend against them. This talk delves into the most well-known Ethereum flaw, re-entrancy, which was first unveiled with a 3.5 million ETH heist (worth $12.5 billion AUD today).

Web Security is an every changing landscape: with sunrises and sunsets of protocols, ciphers, and client capabilities. And while your service you deploy may work, it may be implementing deprecated standards, and nearing he trailing edge of support. We'll cover some of the changes that have happened over the last decade, and then focus on the last 24 months and how you can continue to raise the bar on your workload, with no additional costs.

"In this presentation I’ll run through several campaigns that the PwC threat intelligence team have observed over the past 12 months. Then using these campaigns, show how threat lead mapping against MITRE can help organisations better defend themselves. PwC’s intelligence team tracks 100’s of campaigns every year, from large scale campaigns like Solarwinds to smaller more targeted campaigns against entities across Asia Pacific. As part of our everyday business we dissect these campaigns, determining the threat actors behind them, their motivations, and their likely targets. We also map out these campaigns against the MITRE framework to work out ways to define against the actors. Understanding the targeting and techniques used by threat actors is a key process in our threat lead mitre analysis. I’ll demonstrate how the output of this process can be used to increase organisations defence stand point through increasing their detection coverage. "

"Have you ever been stuck in the airport and run out of the one hour free WiFi? Have you ever been in a hotel that makes you pay for WiFi? Our talk, Unlimited WiFi, helps understand the common flaws within captive portals and proxies. On restricted networks, these methods can be used to exfiltrate information, where it may seem rather difficult, and download necessary exploits (please stop blocking exploit.db… makes pen testing a pain!). Finally, we will talk about how we developed a mini-authentication framework over DNS, allowing us to turn on IoT devices when stuck in a plane and WiFi connectivity is questionable! This talk brings in the concepts of misusing whitelisted software, writing scripts to bypass restrictions, writing your own authentication, and general software vulnerabilities. Our audience should gain a good understanding of the most common weaknesses within our target software and interesting ways to use the flaws they expose to our advantage! "

"This talk will introduce the open source tool Velociraptor for remote incident response. We will cover off concepts, core capabilities, and workflow, then showcase unique functionality that pushes the boundaries beyond expensive paid tools. The goal of the talk is sharing knowledge with the community and hopefully inspire future Velociraptor herders."

Software supply chain attacks are becoming an increasingly large problem, and at Canva we are no different. The problem is becoming increasingly challenging and large in scale due to the complex nature of the software supply chain. This is also caused by the challenges of identifying all the dependencies in your software and tracking compromises of those dependencies. The Canva detection & response team has started their journey in dealing with this threat and wants to share critical lessons they have learnt, and how other organisations can prepare for attacks against their software supply chain.

"Something about InfoSec fundamentals, building the compute platform so its resilient to operator errors, inbound attacks, hardware failures and the like. Protecting against Corporate Policy, Creating graceful failure patterns, Looking after the front-line technical staff. that kind of operational thing. Content to cover OS, virtualisation, SysAdmin/SysOps content."

Ever wondered what application control is? Maybe you've implemented application control and are wondering if you've made any mistakes. Or maybe you, a nefarious hacker, want to know how to bypass it so you can drop your malware. In this talk, we're going to take a look at the various application control methods, and some of the misconfigurations and weaknesses that you might come up against in the wild.

Short range wireless technologies are everywhere. Statistics show that total NFC usage grew by 82% from 2018-2020 and it is estimated that 20% of the worlds population have access to NFC. Novel uses of short range wireless technologies, such as biological RFID and NFC implants are also becoming commonplace. What are the security implications and can they be used offensively?

Bloodhound wins in a complex environment + bloodhound for Linux. Also - If we're running short we will be adding in some Falco wins for Linux and plugging that blind spot and providing some bespoke alert use cases that EDRs might not be able to provide and potential alerting hurdles with commercial EDR solutions ( will place those in a git for everyone to use ).

"This talk will introduce the open source tool Velociraptor for remote incident response. We will cover off concepts, core capabilities, and workflow, then showcase unique functionality that pushes the boundaries beyond expensive paid tools. The goal of the talk is sharing knowledge with the community and hopefully inspire future Velociraptor herders."

From Nigerian princes to questionable medicinal remedies - social engineering, or human hacking, is becoming more of an issue for individuals and organisations. Dive into phishing, vishing and smishing (yes, the latter two are real things), as well as other clever tactics used by attackers both physically and over the internet - cryptocurrency included - to trick you into unknowingly giving access to confidential information and assets.

Learn how to identify such attacks and how you and your organisation can become more aware.

Pretty confident we'll be doing some talking...and hopefully not too much fixing tech on the day!

What if I told you that in 2021 you could still brute-force the PIN on an Android phone?

I will show you how to turn your Kali Nethunter phone into a brute-force PIN cracking machine. Unlike other methods this works on phones out of the box, so you won't need ADB access to your locked phone, or to have previously rooted the Operating System. While not every phone is vulnerable, many are, and the version of Android doesn't matter. Although Android itself is reasonable secure, each handset manufacturer has made their own lock-screen with custom brute-force protection and some of them are easily cracked.