After having an opportunity to go in Israel for a first learning expedition in 2015, I went back last July (2019). Israel is known to be one of the best startup nation. I am going to share with you my experiences: one in the field computer science and the other in cybersecurity.
SheCodes, Tel Aviv (2015)
The first time I went in Israel I attended one of the SheCodes meetup. They presented the different workshops: from basics of web programming to more advanced programming. In these workshops everyone is welcome no matter which level. You will get to learn by doing and be able to ask questions to other attendes or to the mentors.
If you have the opportunity to attend an event made by SheCodes, you definitely should do it, and if you live in Israel you should attend all of them. Since 2015 they even grew they are not only in Tel Aviv anymore but also in Jerusalem, Herzliya, Netanya, … Click here to get more info on their website.
Technion University (2015)
During this learning expedition, I scheduled a visit of Technion University. If you want to do the same, you will have to contact them and provide them a short bio and a brief explanation of why you want to visit. Then, they will help you schedule a guided tour of the University.
Technion is among the world top ten science and technology research university. You can read the full history of this University here. Also, by going to Technion you will have the opportunity to visit the breath taking city of Haifa. And how about taking a snack at Fattoush?
After this, I chilled out at Bahaï gardens!
BSides Tel Aviv 2019
Workshop – Ethical Hacking 101 (July 2019)
For the first day of the Cyber Week of Tel Aviv I attended a workshop hosted by BSides Tel Aviv: Ethical Hacking 101 by Telspace Systems.
After a brief introduction on Ethical Hacking, we were able to practice a little. We used different scanners and tools. There were different environments set up just for us to hack them. We got the opportunity to practice SQL injections, vulnerability scanning, vulnerability exploitations. We saw the full process of pentesting, from looking for vulnerabilities to exploiting them with tips and tricks to stay stealthy while doing so. They also presented a very useful tool, really worth mentioning here: CherryTree. With this you can take notes about your process, this will make the pentest report easier to produce in the end.
This class was an awesome introduction to ethical hacking. The instructors were very clear and passionate. If you have the opportunity to attend a BSides meetup you should totally do it.
The day after the workshops, BSides had organized different talks. They were presented by Keren Elazari, Security Analyst, Author and TED Speaker. There was also a special tent for BSides where you could see their partners. There was an area if you were looking for a job and one just to chill out. I need to add a special mention to the decorations of the stage and the posters. They were awesome! You can see the picture below.
Eva Galperin: Where do we go from here, fighting Spouseware and Stalkerware
Eva Galperin is Director of Cybersecurity at the Electronic Frontier Foundation.
The main points in her talks were the following:
- Stalkerware and Spouseware are not detected by anti-virus
- She conviced Kaspersky to help with the detection of those apps and take privacey seriously
- The tools to fight against this exist
- Laws that already exist need to be enforced
- She is shouting out for people to talk about this.
If you scroll down you will find in the « To go further » section a link to a video of her talk.
Amichai Shulman and Yuval Ron: Alexa and Cortana in Windowsland
They presented different vulnerabilities they found in Cortana and Alexa on windows operated devices.
In the « To go further section » you will find the youtube Channel of Yuval Ron in which you can find some demos.
Sofia Belikovetsky: The Butterfly Effect Actively manipulating VW through hypervisor introspection
Sofia Belikovetsky took the challenge to create a virtual router in order to find anomalies in the network. In this talk she explained how she proceeded to do this: How she was able to find what was going on in the VMs from the outside (from a list of running processes to a monitor of every new processes).
Tomer Zait and Nimrod Levy: ReDTunnel, Explore Internal Networks via DNS Rebinding Tunnel
Tomer Zait and Nimrod Levy presented ReDTunnel how it works and why they created it. In the « To go further » section you will find a link to ReDTunnel Github, why not contribute?
Yossi Sassi: PowerShell as a Hacking Tool
Yossi Sassi shared many tips to get the best of PowerShell as a hacking tool. In the « To go further » section you can find a link to his slides and… a link to Yossi Sassi & The Oriental Rock Ochestra.
Omri Misgav: Bypassing user-mode hooks 101
Omri Misgav is the team leader of the security research team of Ensilo. In this talk he explained hooking and user-mode hooks.
Yaron King: Low hanging (blue) fruit, Hacking and defending yourself using open-source tools
Yaron King explained how he got confronted to password spraying and what he did about it.
Eyal Itkin: Karta Source code assisted Geographic-based binary matching
Eyal Itkin is a vulnerability researcher at Check Point Research. In this talk he explained how Karta works. In the « To go further » section you can find Karta Source code.
Danny Grander and Yuval Ofir from Pasten CTF Team: Capture the Flag
In their talk Danny Grander and Yuval Ofir explained what a CTF is and their experience with them. They also presented how they resolve hard challenges.
Other events of the Cyberweek 2019 in Tel Aviv
Besides BSides (yeah i know xD ), there were plenty of events during the cyberweek. I went to some of them that i will present here.
Women in Cybersecurity: How to attract more diverse talent
Leading Cyber ladies invited inspiring women in. Firstly, Keren Elazari interviewed some of them. They shared their experience and gave some advices :
- Hila Meller, VP Security Europe British Telecom. Her advice: if you want it don’t let anyone stop you. Believe in yourself
- Helen Dixon, Comissioner, DataProtection Comission, Ireland. Her advice: Don’t listen to any advice you are perfect as you are
- Maria Thompson, Chief Risk Officer State of North Carolina. Her advice: Learn foundations of IT if you are able to achieve and do that you will be more successful.
After those interview Eva Galperin, Director of Cybersecurity and Head of Threat Lab, Electronic Frontier Foundation, presented herself and her career in a brief talk.
Finally, there was a panel moderated by Reut Menashe, co founder of BSides TLV.
Each person from the panel presented their background. Then they shared what and why in their opinion companies should do more to attract more talent.
- For Limor Kessem, mono culture has a bad effect. She also said that there is an impact on diversity with the « bring a friend policy ». In fact, with this kind of policy companies tend to hire the same kind of people.
- For Mary McGinley, companies need to have an extremly diverse team to see all aspects of a problem. She reminded the study that said that women won’t apply to a job if they do not fit 100% of the criterias. She advises that even if many people tell you that you should not apply, apply anyway. She added « do something you love and make it work for yourself ».
- Karine Ben-Simhon, said that it’s important to encourage private and public sector to make equal opportunities. She also said that there is also a problem with women because most of HR staff are women.
- For Moran Weber, the best way to make a difference is by combining top down and bottom up approach. It’s also important to revise the job description and understand why women don’t apply. In her opinion those descriptions should avoid terms like « ninja code », « superstar », « rockstar », etc. She shared that her best decision was to start putting herself out there and to decide that her imposter syndrom would not decide for her. She used it to help her learn more.
Plenary talk CyberWar is the continuation of politics by other means: interview of Stevan Bernard by Keren Elazari
In this interview Stevan Bernard explained how the attack on Sony Pictures of november 2014 was handled. Here are the main points he shared:
- Never underestimate your enemy.
- Decisions made on Day 1 are the decisions that saved the company. This day was all about global and big decisions. This is when they decided to call the FBI and cyber security companies.
- The human link is the weakest link: the attack started with spear phishing.
- With twelve thousand employees all over the world, in such attack, you need to find alternative ways to communicate: Sony used old blackberry phones.
- You can’t prepare enough: hire the right people, make the right decisions, get every one on the same page and define roles and responsibilities.
This event was a full day event. All along the day awards for « Legends of fraud fighting » were given and the winners shared their experience. I am going to present some talks of the day.
Limor Kessem, executive security advisor at IBM opened the day. She made an iventory of the last few years in terms of malwares and presented some of them. After her introduction different talks were given.
Ori Wainshtein: Thinking beyond traditional fraud
Ori Wainshtein is Head of Risk Research and Intelligence at Intuit. After a presentation of Intuit, he explained that in his opinion we need to be able to educate our children about this. He presented different aspects of fraud prevention and some scams. To conclude he gave key advices: Invest in customer safety, optimize for brand protection and develop holistic point of view on fraud.
Panel: news from the kingdom
In this panel participants shared the lancaspe of UK in terms of fraud. Some figures were presented: reported fraud increased by 6% since 2009. Indentity fraud has been the biggest issue for a while and in 2018 it is more than ever, 85% of it is perpetrated online. They also tackled the issue of fraud detection and how to detect it.
Panel: tales from the colonies
In this panel, they started to talk about mobile attacks saying that the minute something is patched, something new is out. Companies have to make things safer without changing too much the customer experience.
Nadav Katzenell: Remote overlay trojans attack and detection
Nadav Katzenell is head of ecurity researcher at IBM Security. In this talk he explained Remote overlay trojan attack. It is an attack that originated in Brazil and then quickly expended in South America and to new industries. Then he explained how his team set up a solution to detect this kind of attack.
Yehonatan Bar-Lev: The power of fusion center
Yehonatan Bar Lev is head of Cyber Center at the Bank Hapoalim. Yehonatan Bar Lev showed us the organization of a drug ring from the inside. What skills they have, how they work, how they hire staff and what type of attack they launch.
Mirko Manske: A sunday in hell
Mirko Manske is a federal criminal police officer in Germany. In this talk he explained how his team and him confronted an internet « provider from hell » to collaborate with them on a special case. He gave us an inside view of how german police and prosecutors work on such cases.
Panel ecommerce fraud, the next generation
In this panel, Noa Kind started to explain what Ad Fraud is and how it was countered. Then, other persons from the panel explained how consulting works.
Karisse Hendrix: fighting online fraud is a lot like fighting zombies
Karisse Hendrick is an eCommerce Chargebacks & Fraud Consultant. In this talk she explained how online fraud evolved and her insights as a consultant. She also co-host a podcast that you can find in the « to go further » section.
Spencer McLain: Fighting fraud with collaboration
Spencer McLain is Vice President at Ekata. In this talk he first explained that online sales are increasing in order to tackle the authorization rate and fraud problem. He showed how fraud and solutions to fraud evolved, he gave a holistic approach to fraud prevention.
Sergey Shykevich: Even idiots can do fraud
Sergey Shykevich is cyber threat intelligence team manager at Q6 Cyber. In this talk, Sergey Shykevich explained that even with very basic knowledge anyone could do fraud. To prove his point he even showed an example.
Raymond King: Robbing the digital train
Raymond King is a product manager at TransferWise. In this talk, firstly he presented TransferWise. Then he explained to what kind of fraud TransferWise is confronted and the consequences it has and how they prevented them.
Ethan Ram: Fraudulent App installs
Ethan Ram is VP R&D at ZoomD. In this talk he explains what is App Install Fraud, how it works and how to fight it.
Panel: What’s new in marketplace fraud
In this panel, they all shared their insights from their different companies. Firstly they shared the kind of fraud they are confronted to. Then they gave their opinions about machine learning and artificial intelligence to detect fraud. They talked about the collaborations they have with other platforms in the marketplace. Finally they shared some advice to fraud fighting teams.
To hapilly finish the day at FraudCon we did a fun little game in which we had to define if the case presented to us was « friendly fraud » or « true fraud ».
Learning expeditions are a really good way to learn. You get to see different things and discover the world at the same time. The CyberWeek was an awesome experience, i really enjoyed the talks and got to learn a lot. If you have the opportunity to go to the CyberWeek you definitely have to go to BSides TLV and FraudCon.
To go further
- BSides TLV
- CyberWeek Tel Aviv
- Eva Galperin Video of Where do we go from here at The SAS Con 2019
- Yuval Ron’s Youtube channel
- ReDTunnel Github
- Slides of PowerShell as a Hacking Tool by Yossi Sassi
- If you like rock music Yossi Sassi is also a guitarist 😀
- Karta’s source code
- The online-fraudcast, Karisse Hendrix and Brett Johnson