Difference between revisions of "AFSecurity Seminar"

From mn/ifi/AFSecurity
Jump to: navigation, search
Line 1: Line 1:
 
== PKI for Id Cards ==
 
== PKI for Id Cards ==
  
'''DATE:''' Thursday 6 October 2016. 12:00h
+
'''DATE:''' Friday 25 November 2016. 13:00h
  
 
'''LOCATION:'''  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.
 
'''LOCATION:'''  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.
Line 7: Line 7:
 
'''AGENDA:'''
 
'''AGENDA:'''
  
12:00h Welcome at IFI
+
13:00h Welcome at IFI
  
12:15h Talk: '' PKIs for Norwegian Passports and National Id Cards''
+
13:15h Talk: ''Software Vulnerabilities and Exploitation Methods ''
  
13:00h Discussion
+
14:00h Discussion
  
'''SPEAKER:''' Tage Stabell-Kulø (Unibridge)
+
'''SPEAKER:''' Laszlo Erdodi, University of Agder
  
 
'''ABSTRACT:'''
 
'''ABSTRACT:'''
The public information stored on the chip of Norwegian passports and National ID cards is digitally signed by Norwegian authorities. The public key is a self-signed key which is also part of a global PKI (Public-Key Infrastructure). The confidential information stored on the chip, which includes fingerprints, is protected by keys managed under another PKI. Furthermore, the cryptographic protocols used in the communication between the chip and the terminal reader are based on the use of temporary ephemeral public keys.
+
Vulnerable software is a frequently used attacker tool and thus the research connected to these types of vulnerabilities is of high relevance. The exploitation of software vulnerabilities is highly challenging and it is an up-to-date topic in the field of cyber security nowadays. Vulnerable software can cause denial of service and beside this even arbitrary commands will be executed if the attacker provides some crafted input data. In special cases the vulnerable software can establish connection from the internal network and use some kind of covert channel to communicate to a remote command and control server to implement malicious tasks.
 +
Since people use more and more complex software in all fields of the life, it happens often that extremely popular tools turn out to be extremely vulnerable (e.g. pdf readers, web browsers, operating systems, etc.). Because of all these the presentation will first introduce and analyse the typical software vulnerabilities.
 +
 
 +
Connected to the vulnerabilities the vulnerability finding methods (code analysis, input data fuzzing, in memory fuzzing) will also be shown. Finding zero day vulnerability is always highly relevant and really challenging.  
 +
 
 +
The presentation will also approach the problem of software vulnerability form the aspect of the possible malicious actions that are implemented due to it: the most up to date software vulnerability exploitation methods will be presented in details through interesting and surprising practical examples.
  
This talk describes the two PKIs and gives a brief introduction to temporary asymmetrical keys.
 
  
 
'''SPEAKER BIO:'''
 
'''SPEAKER BIO:'''
Dr. Tage Stabell-Kulo has since 1992 been interested in the use of public keys, their potential, and their limitations. He holds a Cand.Scient. degree in distributed systems from the University of Tromsø, and a Doctoral degree from the University of Twente, Netherlands. His PGP key (71FBD469) is from June 1994.
+
Dr. Laszlo Erdodi has a PhD in Information Security, is a Certified Ethical Hacker (CEH), and a System Security Certified Practitioner (SSCP). Since 2014 he has worked as a researcher at the University of Agder, Department of ICT.
 +
 
 +
His main research areas are: Information Security and Ethical Hacking, Software Vulnerabilities and exploitation, Secure Programming, and Malware analysis.
 +
 
 +
His cyber security related activities include: trainer of courses on ethical hacking and exploit writing (hardcore hacking), continuous penetration testing, continuous research on cyber security and participation in big research projects (e.g. Smart house security, SCADA security).

Revision as of 10:03, 7 November 2016

PKI for Id Cards

DATE: Friday 25 November 2016. 13:00h

LOCATION:  Kristen Nygaards sal (room 5370), Ole Johan Dahl's House.

AGENDA:

13:00h Welcome at IFI

13:15h Talk: Software Vulnerabilities and Exploitation Methods

14:00h Discussion

SPEAKER: Laszlo Erdodi, University of Agder

ABSTRACT: Vulnerable software is a frequently used attacker tool and thus the research connected to these types of vulnerabilities is of high relevance. The exploitation of software vulnerabilities is highly challenging and it is an up-to-date topic in the field of cyber security nowadays. Vulnerable software can cause denial of service and beside this even arbitrary commands will be executed if the attacker provides some crafted input data. In special cases the vulnerable software can establish connection from the internal network and use some kind of covert channel to communicate to a remote command and control server to implement malicious tasks. Since people use more and more complex software in all fields of the life, it happens often that extremely popular tools turn out to be extremely vulnerable (e.g. pdf readers, web browsers, operating systems, etc.). Because of all these the presentation will first introduce and analyse the typical software vulnerabilities.

Connected to the vulnerabilities the vulnerability finding methods (code analysis, input data fuzzing, in memory fuzzing) will also be shown. Finding zero day vulnerability is always highly relevant and really challenging.

The presentation will also approach the problem of software vulnerability form the aspect of the possible malicious actions that are implemented due to it: the most up to date software vulnerability exploitation methods will be presented in details through interesting and surprising practical examples.


SPEAKER BIO: Dr. Laszlo Erdodi has a PhD in Information Security, is a Certified Ethical Hacker (CEH), and a System Security Certified Practitioner (SSCP). Since 2014 he has worked as a researcher at the University of Agder, Department of ICT.

His main research areas are: Information Security and Ethical Hacking, Software Vulnerabilities and exploitation, Secure Programming, and Malware analysis.

His cyber security related activities include: trainer of courses on ethical hacking and exploit writing (hardcore hacking), continuous penetration testing, continuous research on cyber security and participation in big research projects (e.g. Smart house security, SCADA security).