Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. secwest.net/llm-purple-test-…

Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. secwest.net/llm-purple-test-…

CanSecWest 2024 Presentation: The Cat is Out of the Bag: Regulating AI in Canada Anna Manley - Manley Law Inc. / ACTI The Artificial Intelligence and Data Act (Bill C-27) is in the first reading stage in Parliament. The legislation purports to regulate AI as part of sweeping reforms related to technology in Canada. Will this regulation change the application of AI to cybersecurity? Are there loopholes? Is it too early for regulation? Will regulation go too far or not far enough? How we attempt to regulate AI tells us much about how we view emerging technologies from both philosophical and practical perspectives. She’ll review the legal landscape of AI in Canada and discuss our attempts to regulate emerging technologies in the broader social and political context of who we are and where we’re going.

CanSecWest 2024 Presentation: Electric Vehicle Chargers: Observations from Pwn2Own Automotive 2024 by Jonathan Andersson, Trend Micro Research Labs (And a reminder that we are giving a 20% discount to automotive industry participants. Contact: [email protected]) secwest.net

Apropos of Automotive Security. Ironically, it's one of the focus areas of our presentations this year at CanSecWest. CanSecWest 2024 Presentation: Death By A Thousand Cuts: Compromising Automotive Systems via Vulnerability Chains Linfeng Xiao The intersection of new energy vehicles, intelligent networking, and traditional automotive manufacturing has significantly blurred the lines between cybersecurity and physical security. As vehicles become increasingly connected, the paradigm of threats has shifted from physical attacks, such as those on car keys, to sophisticated cyber attacks originating from the internet. This change raises a critical question: are modern vehicles equipped to fend off such cyber threats effectively? Our research aims to demonstrate the feasibility of remotely compromising a new energy vehicle without any physical interaction. With over 11 million new energy vehicles produced and sold globally, we embarked on a black box security analysis across various models. This journey took us from an initial lack of debugging access to successfully creating exploit chains that leverage multiple vulnerabilities for vehicle theft. Our methodology highlights the intricate process of identifying and chaining together remote code execution (RCE) and privilege escalation vulnerabilities to gain unauthorized control over the vehicle. We delve into the technical specifics of discovering multiple RCE and privilege escalation vulnerabilities across different vehicle models and how these can be exploited via in-vehicle communication technologies. Our findings illustrate the potential for post-exploitation manipulation of critical vehicle components, including doors and windows, and even circumventing the Passive Entry Passive Start (PEPS) system. By expanding the attack surface for contactless assaults, we emphasize the broad implications of RCE vulnerabilities. The presentation concludes with an analysis of the current state of new energy vehicle security, offering targeted recommendations to automakers for enhancing their vehicles' resilience against cyber threats. secwest.net

CanSecWest, 25th year. Take your chances @ RandomNewCon, or experience Vancouver's diversity, get pampered, fed well, by our experienced team (still only con with Second Breakfast), see leading edge research in our single track, and a 30m taxi to Grouse for day/night skiing or a short excursion before or after for North America's best skiing at Whistler. Your pick. secwest.net

Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. secwest.net/llm-purple-test-…

Get ready to level up! CanSecWest 2024 Dojos are here 💪 Master Rust for security Conquer C2 with Sliver Harness AI for threat hunting Dive into GraphQL attack and defense Red team like a pro Attack cloud environments Become a full-stack pentester Battle Linux, Docker, Kubernetes weaknesses Windows kernel exploits revealed Xeno's ultimate skills buffet! In-person & online options. Details & registration 👉 secwest.net/csw24-dojos

New CanSecWest 2024 Dojo (part 2): Advanced Offensive GraphQL Security Training by Nick Aleks and Jared Meit Master GraphQL hacking with one of the authors of Black Hat GraphQL. This (part 2) advanced hacking course builds on top of the foundational knowledge you gained about GraphQL internals in part 1. Leveraging a custom hacking lab, you’ll delve into the details of how to execute numerous GraphQL attacks such as: Reconnaissance Techniques Information Disclosure Denial of Service Attacks Authentication & Authorization Bypasses Injection Exploits Request Forgery & Hijacking Cross-site request forgery Server-side request forgery What to Expect? -Hands-on GraphQL Offensive Security Learning -Use your own GraphQL Hacking Lab to detect and exploit vulnerabilities -Utilize GraphQL hacking tools like Graphw00f to discover and fingerprint GraphQL implementations -Learn about the GraphQL server implementations ecosystem -Convert theoretical knowledge about GraphQL weaknesses and apply them to practical attacks -Write your own GraphQL exploit code to automate attacks -Bypass common defences using native GraphQL features like batched queries and field suggestions -Gain insight into current trends and future plans for GraphQL Course Learning Objectives: Master GraphQL hacking tools and understand how and why they work Perform reconnaissance activities to detect GraphQL targets allowing you to fingerprint implementation details and tailor future attacks Craft a myriad of GraphQL queries which could result in Denial of Service and system performance degradation Disclose schema details by abusing introspection and learn how bypass controls intended to disable direct schema access Analyze and attack GraphQL authentication and authorization controls, using features like alias-based batched queries to brute force credentials Gain database and operating system access by injecting payloads into GraphQL operations Forge and hijack GraphQL client sessions using GraphQL-specific CSRF, SSRF, and WebSocket-based GraphQL subscription attacks Learn about publicly disclosed GraphQL vulnerabilities and the exploits through work of bug bounty hunters and security researchers Who Should Attend This training program is for anyone who is interested in learning how to break GraphQL APIs through applied offensive security testing. Whether you’re a penetration tester who has heard of GraphQL and want to develop your hacking expertise, a security analyst looking to improve your knowledge of how to defend GraphQL APIs, or a software engineer planning to build a GraphQL-backed application, you should gain a lot of useful information from this course. About the Instructors: Nick Aleks is the other co-author of the No Starch Press book - Black Hat GraphQL and is also the creator of two GraphQL hacking utilities, the GraphQL Threat Matrix and CrackQL. Nick is also the senior director of security at Wealthsimple, the other co-founder of DEFCON Toronto, and CEO of ASEC.IO. He’s also a board member at HackStudent and The University of Guelph’s Master of Cybersecurity and Threat Intelligence program. He’s hacked everything from websites to safes, cars, and even smart buildings. Jared Meit, OSWE, has always had a passion for taking things apart, learning how they work, and forgetting how to put them back together. He was a professional software developer for 12 years before shifting his focus to Application Security 5 years ago. His dev experience allows him to create tools that developer's will actually want to use.

New CanSecWest 2024 Dojo: Foundational GraphQL Attack Surface Training by Nick Aleks and Jared Meit GraphQL, a query language for APIs and a runtime for executing those queries by using a type system you define for your data, has emerged as a pivotal technology in modern software architectures. It offers a more efficient, powerful, and flexible alternative to the traditional REST API. It allows clients to request exactly the data they need, reducing the amount of data transferred over the network and improving performance, especially in mobile applications where bandwidth is a premium resource. Learn about GraphQL hacking from one of the authors of "Black Hat GraphQL." This crash course into GraphQL will give you a hands-on approach to learning about how this rapidly adopted API technology works and how its internals can be used as attack vectors. You'll learn: -Basics of GraphQL communications, language and type system -Build your own GraphQL hacking lab with a vulnerable target server and popular GraphQL hacking utilities -Understand the basics of GraphQL vulnerabilities What to Expect? -Hands-on GraphQL Learning, from zero to hero -Build your own GraphQL Hacking Lab -In-depth overview of GraphQL’s Language & Type System, and the software ecosystem -High level introduction to common GraphQL weaknesses -Gain foundational knowledge required to execute advanced offensive GraphQL attacks -You’ll explore and learn GraphQL through the lens of a hacker -Understand why some of the biggest companies are starting to use GraphQL and how it compares to RESTful APIs -Discover GraphQL’s internals and understand how its language and type system can be manipulated against itself -Establish your own GraphQL hacking lab, complete with a dedicated GraphQL API target to perform your attacks against -Execute your first few GraphQL queries and get comfortable with this new API paradigm. Who Should Attend: This training program is for anyone who is interested in learning how to break GraphQL APIs through applied offensive security testing. Whether you’re a penetration tester who has heard of GraphQL and want to develop your hacking expertise, a security analyst looking to improve your knowledge of how to defend GraphQL APIs, or a software engineer planning to build a GraphQL-backed application, you should gain a lot of useful information from this course. -Information security professionals -Bug hunters & Red Teamers -GraphQL Developers -Security Engineers & Analysts -Anyone with interest in understanding GraphQL exploitation -Ethical hackers and penetration testers looking to upgrade their GraphQL exploitation skills This course is the first part of a two part course, the second being more advanced attack techniques. About the Instructors: Nick Aleks is the other co-author of the No Starch Press book - Black Hat GraphQL and is also the creator of two GraphQL hacking utilities, the GraphQL Threat Matrix and CrackQL. Nick is also the senior director of security at Wealthsimple, the other co-founder of DEFCON Toronto, and CEO of ASEC.IO. He’s also a board member at HackStudent and The University of Guelph’s Master of Cybersecurity and Threat Intelligence program. He’s hacked everything from websites to safes, cars, and even smart buildings. Jared Meit, OSWE, has always had a passion for taking things apart, learning how they work, and forgetting how to put them back together. He was a professional software developer for 12 years before shifting his focus to Application Security 5 years ago. His dev experience allows him to create tools that developer's will actually want to use.

Get ready to level up! CanSecWest 2024 Dojos are here 💪 Master Rust for security Conquer C2 with Sliver Harness AI for threat hunting Dive into GraphQL attack and defense Red team like a pro Attack cloud environments Become a full-stack pentester Battle Linux, Docker, Kubernetes weaknesses Windows kernel exploits revealed Xeno's ultimate skills buffet! In-person & online options. Details & registration 👉 secwest.net/csw24-dojos

New CanSecWest 2024 Dojo (part 2): Advanced Offensive GraphQL Security Training by Nick Aleks and Jared Meit Master GraphQL hacking with one of the authors of Black Hat GraphQL. This (part 2) advanced hacking course builds on top of the foundational knowledge you gained about GraphQL internals in part 1. Leveraging a custom hacking lab, you’ll delve into the details of how to execute numerous GraphQL attacks such as: Reconnaissance Techniques Information Disclosure Denial of Service Attacks Authentication & Authorization Bypasses Injection Exploits Request Forgery & Hijacking Cross-site request forgery Server-side request forgery What to Expect? -Hands-on GraphQL Offensive Security Learning -Use your own GraphQL Hacking Lab to detect and exploit vulnerabilities -Utilize GraphQL hacking tools like Graphw00f to discover and fingerprint GraphQL implementations -Learn about the GraphQL server implementations ecosystem -Convert theoretical knowledge about GraphQL weaknesses and apply them to practical attacks -Write your own GraphQL exploit code to automate attacks -Bypass common defences using native GraphQL features like batched queries and field suggestions -Gain insight into current trends and future plans for GraphQL Course Learning Objectives: Master GraphQL hacking tools and understand how and why they work Perform reconnaissance activities to detect GraphQL targets allowing you to fingerprint implementation details and tailor future attacks Craft a myriad of GraphQL queries which could result in Denial of Service and system performance degradation Disclose schema details by abusing introspection and learn how bypass controls intended to disable direct schema access Analyze and attack GraphQL authentication and authorization controls, using features like alias-based batched queries to brute force credentials Gain database and operating system access by injecting payloads into GraphQL operations Forge and hijack GraphQL client sessions using GraphQL-specific CSRF, SSRF, and WebSocket-based GraphQL subscription attacks Learn about publicly disclosed GraphQL vulnerabilities and the exploits through work of bug bounty hunters and security researchers Who Should Attend This training program is for anyone who is interested in learning how to break GraphQL APIs through applied offensive security testing. Whether you’re a penetration tester who has heard of GraphQL and want to develop your hacking expertise, a security analyst looking to improve your knowledge of how to defend GraphQL APIs, or a software engineer planning to build a GraphQL-backed application, you should gain a lot of useful information from this course. About the Instructors: Nick Aleks is the other co-author of the No Starch Press book - Black Hat GraphQL and is also the creator of two GraphQL hacking utilities, the GraphQL Threat Matrix and CrackQL. Nick is also the senior director of security at Wealthsimple, the other co-founder of DEFCON Toronto, and CEO of ASEC.IO. He’s also a board member at HackStudent and The University of Guelph’s Master of Cybersecurity and Threat Intelligence program. He’s hacked everything from websites to safes, cars, and even smart buildings. Jared Meit, OSWE, has always had a passion for taking things apart, learning how they work, and forgetting how to put them back together. He was a professional software developer for 12 years before shifting his focus to Application Security 5 years ago. His dev experience allows him to create tools that developer's will actually want to use.

New CanSecWest 2024 Dojo: Foundational GraphQL Attack Surface Training by Nick Aleks and Jared Meit GraphQL, a query language for APIs and a runtime for executing those queries by using a type system you define for your data, has emerged as a pivotal technology in modern software architectures. It offers a more efficient, powerful, and flexible alternative to the traditional REST API. It allows clients to request exactly the data they need, reducing the amount of data transferred over the network and improving performance, especially in mobile applications where bandwidth is a premium resource. Learn about GraphQL hacking from one of the authors of "Black Hat GraphQL." This crash course into GraphQL will give you a hands-on approach to learning about how this rapidly adopted API technology works and how its internals can be used as attack vectors. You'll learn: -Basics of GraphQL communications, language and type system -Build your own GraphQL hacking lab with a vulnerable target server and popular GraphQL hacking utilities -Understand the basics of GraphQL vulnerabilities What to Expect? -Hands-on GraphQL Learning, from zero to hero -Build your own GraphQL Hacking Lab -In-depth overview of GraphQL’s Language & Type System, and the software ecosystem -High level introduction to common GraphQL weaknesses -Gain foundational knowledge required to execute advanced offensive GraphQL attacks -You’ll explore and learn GraphQL through the lens of a hacker -Understand why some of the biggest companies are starting to use GraphQL and how it compares to RESTful APIs -Discover GraphQL’s internals and understand how its language and type system can be manipulated against itself -Establish your own GraphQL hacking lab, complete with a dedicated GraphQL API target to perform your attacks against -Execute your first few GraphQL queries and get comfortable with this new API paradigm. Who Should Attend: This training program is for anyone who is interested in learning how to break GraphQL APIs through applied offensive security testing. Whether you’re a penetration tester who has heard of GraphQL and want to develop your hacking expertise, a security analyst looking to improve your knowledge of how to defend GraphQL APIs, or a software engineer planning to build a GraphQL-backed application, you should gain a lot of useful information from this course. -Information security professionals -Bug hunters & Red Teamers -GraphQL Developers -Security Engineers & Analysts -Anyone with interest in understanding GraphQL exploitation -Ethical hackers and penetration testers looking to upgrade their GraphQL exploitation skills This course is the first part of a two part course, the second being more advanced attack techniques. About the Instructors: Nick Aleks is the other co-author of the No Starch Press book - Black Hat GraphQL and is also the creator of two GraphQL hacking utilities, the GraphQL Threat Matrix and CrackQL. Nick is also the senior director of security at Wealthsimple, the other co-founder of DEFCON Toronto, and CEO of ASEC.IO. He’s also a board member at HackStudent and The University of Guelph’s Master of Cybersecurity and Threat Intelligence program. He’s hacked everything from websites to safes, cars, and even smart buildings. Jared Meit, OSWE, has always had a passion for taking things apart, learning how they work, and forgetting how to put them back together. He was a professional software developer for 12 years before shifting his focus to Application Security 5 years ago. His dev experience allows him to create tools that developer's will actually want to use.

CanSecWest Presentation: Rolling in the Dough: How Microsoft Identified and Remediated a Baker’s Dozen of Security Threats in the Windows DNS Server George Hughey, Microsoft secwest.net

CanSecWest Presentation by @kutyacica There Will Be Bugs: Exploiting Basebands in Radio Layer Two

Apropos of Automotive Security. Ironically, it's one of the focus areas of our presentations this year at CanSecWest. CanSecWest 2024 Presentation: Death By A Thousand Cuts: Compromising Automotive Systems via Vulnerability Chains Linfeng Xiao The intersection of new energy vehicles, intelligent networking, and traditional automotive manufacturing has significantly blurred the lines between cybersecurity and physical security. As vehicles become increasingly connected, the paradigm of threats has shifted from physical attacks, such as those on car keys, to sophisticated cyber attacks originating from the internet. This change raises a critical question: are modern vehicles equipped to fend off such cyber threats effectively? Our research aims to demonstrate the feasibility of remotely compromising a new energy vehicle without any physical interaction. With over 11 million new energy vehicles produced and sold globally, we embarked on a black box security analysis across various models. This journey took us from an initial lack of debugging access to successfully creating exploit chains that leverage multiple vulnerabilities for vehicle theft. Our methodology highlights the intricate process of identifying and chaining together remote code execution (RCE) and privilege escalation vulnerabilities to gain unauthorized control over the vehicle. We delve into the technical specifics of discovering multiple RCE and privilege escalation vulnerabilities across different vehicle models and how these can be exploited via in-vehicle communication technologies. Our findings illustrate the potential for post-exploitation manipulation of critical vehicle components, including doors and windows, and even circumventing the Passive Entry Passive Start (PEPS) system. By expanding the attack surface for contactless assaults, we emphasize the broad implications of RCE vulnerabilities. The presentation concludes with an analysis of the current state of new energy vehicle security, offering targeted recommendations to automakers for enhancing their vehicles' resilience against cyber threats. secwest.net

CanSecWest 2024 Presentation: Electric Vehicle Chargers: Observations from Pwn2Own Automotive 2024 by Jonathan Andersson, Trend Micro Research Labs (And a reminder that we are giving a 20% discount to automotive industry participants. Contact: [email protected]) secwest.net