[Disobey 2020] Let's get physical - Timo Hirvonen & Robert Bearsby

― Disobey

Disobey: https://disobey.fi/ Follow us on twitter: https://twitter.com/disobey_fi Offensive security professionals need to increase the sophistication of their tactics, techniques and procedures (TTPs) in order to accomplish their goals due to the improvements in security culture and the sophistication of security products. Timo and Robert have been on a quest to find a way around modern EDR with regard to credential theft. As part of this presentation, the team will: * Discuss the evolution of credential theft and the reasons why alternative approaches are required * Introduce and opensource ‘physmem2profit’, a tool that can be used to retrieve credentials and secrets without alerting the blue team * Recommend approaches that can be used to detect and mitigate this technique Timo Hirvonen, Senior Security Consultant, F-Secure Consulting Timo has been with F-Secure since 2010. Whilst working in F-Secure’s Tactical Defense Unit (TDU), Timo specialized in exploit analysis and studied the latest tricks used by advanced threat actors. Timo joined F-Secure Consulting in 2016, and now enjoys protecting enterprises with his offensive security research and through the delivery of Red Team engagements. Timo's previous research includes cold boot (Disobey 2018) and Ghost in the Locks (INFILTRATE 2018, HITB 2018, 44con 20178). He has also presented in multiple other conferences, including Black Hat USA 2014. Robert Bearsby, Senior Security Consultant, F-Secure Consulting Robert began his infosec career at MWR InfoSecurity in London. Following F-Secure’s acquisition of MWR in July 2018, Robert moved to Helsinki to work as part of the consulting team in the Nordics. Robert is mainly focused on understanding the Tactics, Techniques and Procedures (TTPs) used by advanced threat actors and predominantly works on attack simulations as part of F-Secure’s Red Team.

#disobey #disobey2020

Keräyksessä Tietoturva 2020-2021

Alkuperäislähde: https://www.youtube.com/watch?v=DXkd56WP_Oc

Sivun kuvailutiedot ovat peräisin alkuperäislähteestä (YouTube).