6.-7.June 2024
Komplex457 Zürich

Welcome to Area41! Please keep your barcode ready. Once you got your badge, please help yourself to coffee and grab a seat for the opening ceremony!

Let Adrian, Candid and Stefan welcome you to Area41 2022 and give you some last-minute info about the event before handing the stage over to this year's keynote speaker!

It has generally been accepted that vulnerabilities will endlessly be discovered and patched because the humans developing the software or hardware are prone to making errors. Though this holds some truth, accepting it as a foregone conclusion has given vendors an easy excuse to sell vulnerable products and even profit from it.
During a vulnerability research project, my team and I discovered several vulnerabilities in McAfee (now Trellix) products, ranging from trivial Cross-Site Scripting issues to SQL injections and Admin account takeover in the ePolicy Orchestrator. Most of these issues were discovered within just a couple weeks of effort using command-line tools such as find and grep.
These vulnerabilities will be presented and used as a steppingstone to discuss why we so easily discover SQL injections or even Buffer Overflows in the query strings of popular products.
Though it may seem utopian to have a vulnerability-free world, aligning incentives and allowing customers to know how much vendors value the security of their own products (and ultimately that of their customers) could go a long way in improving on the current state and better protect everyone.


Bio:
Alain Mowat joined SCRT in 2008 as a penetration tester and subsequently led the pentesting team in the same company for many years until turning towards Research & Development. While still performing various engagements throughout the year, Alain is also dedicated to exploring new approaches to be used by the offensive security industry to better secure client infrastructures. Aside from these activities, Alain was an active member in the 0daysober CTF team that finished 3rd at DEFCON CTF in 2015 and has responsibly disclosed vulnerabilities in multiple products such as Citrix NetScaler, SonicWall SRA & SMA, Barracuda, Twitter and McAfee’s ePolicy Orchestrator. Alain is also responsible for giving various security-related trainings at SCRT and has presented at several Swiss conferences, such as Insomni’hack, Secure IT VS CyberSecurity Alliance and SIGS.

Adversary simulation and red team operations play a crucial role in fortifying defences against sophisticated adversaries. As defences getting better and EDR systems being deployed everywhere, malware development is becoming an important skill for red teamers.
Red teamers are often in need to develop custom loaders capable of bypassing these defences. Developing a modern, customizable, and evasive loader involves multiple steps, which can be a time-consuming and complex process. Often multiple existing malware techniques need to be combined and adapted to the respective situation. This talk delves into my journey of automating malware development to create loaders for red team operations and discusses the challenges I faced.


Bio:
Gian Demarmels is a former information security engineer in the e-commerce field and now works as a security tester at Redguard. As part of Redguard's offensive security team, Gian conducts penetration tests, attack simulations and red teaming operations, with a special interest in EDRs, evasion tactics and malware development in general. During the last year, Gian delved deep into this fascinating world of malware development and went down the rabbit hole of creating an internal framework to generate customizable and evasive shellcode loaders for various red team operations.

With current Bitcoin price increase, Crypto got more attention in the public, again - though underlying misuse, attacks and hacks are going on for many years. In this talk I will dig into different recent attacks, problems and common “how to behave”. I will cover starting from the more common attack methods to advanced and stepping into DeFi.


Bio:
Marco Preuss has been working in the area of networking and IT security since the early 2000s. Having a long time experience in his role, he is responsible for monitoring the threat landscape in Europe while specializing in threat intelligence, darknet research, password security, IoT security. and privacy. In addition to research-related projects, Preuss is a regular speaker at both closed and public events.