International Cyber Security Summer School 2019 (ICSSS 2019)

ICSSS 2019 in The Hague

In the end of august i participated to ICSSS 2019 in The Hague (Netherlands). We had different lectures about cybersecurity in various places such as Leiden University, NCI Agency, Europol, The Hague Security Delta, Dutch innovation factory. We also had the full week to work on different challenges in groups. My challenge was about Cyber resilience for The Hague Center for Strategic Studies.

What is ICSSS 2019?

« The International Cyber Security Summer School (ICSSS) is an annual summer school, originally organised by NATO C&I Agency, Europol, the Netherlands Ministry of Defence Cyber Command, Leiden University and The Hague Security Delta. « 

Source: ICSSS website

What happened?

Day 1

Day 1 of ICSSS 2019

Useful to know about Day 1:

The ice breaker game:

The afternoon was animated by Ákos Wetters. Akos offered an app for an Ice Breaker game called SpotYet. We had to take a selfie and answer questions about ourselves. Then, the app showed us the picture of the person we had to talk to and after finding the person, we could talk about our answers or about anything else we fancied. It gave us the possibility to have one on one conversation instead of having to introduce ourselves in front of 60 other persons. Here is a map of our interconnection during the event made by SpotYet.

SpotYet interconnexions map of our ice breaker game

A blue team vs red team workshop

Scenario of red team versus blue team game

The red team versus blue team game was made by Leila Taghizadeh. The read team is suppose to hack the blue team. The red team had to explain the process they would use to hack the company. The blue team had to explain how they would protect themselves.

ICSSS Tweet about Day 1

Day 2

Day 2 of ICSSS 2019

Useful to know about Day 2:

  • The lecture of the morning by Professor Bibi Van Den Berg was a broad overview of cyberspace. The following subjects were tackled: Human error and cybersecurity incidents, Law as an incentive to prevent human error, alternative way of steering human behavior.
  • The workshop of the afternoon was made by Els de Busser. It was an exercise about NotPetya. We were divided in groups some represented the Russian and the others, the Ukrainian. We had to build an argumentation to defend the team we were in so that we could give our point of view in front of the International court of law.
ICSSS tweet about Day 2

Day 3

Day 3 at ICSSS 2019

Useful to know about Day 3:

The subject tackles in the keynotes were as follow: Introduction to the NCI Agency, Cyber Security at the NCI Agency, Career opportunities at the NCI Agency.

NCI Agency’s tweet about Day 3

Day 4

Day 4 at ICSSS 2019

Useful to know about Day 4:

  • The keynotes were made by Maia Spilman and Michael Payne.
  • In the first workshop of the afternoon we saw how to transform a Raspberry Pi into a hacking tool. It was lead by Niels Vonk and Ramon Janssen
  • In the second workshop of the afternoon we worked on a home made version of OWASP Juice shop. It was lead by Wout Debaenst and Ricardo Sanchez Marchand.
ICSSS tweet about Day 4

Day 5

Day 5 at ICSSS 2019

Useful to know about Day 5:

The subjects tackled in the morning lecture by Jarek Jakubcek were : Introduction to Europol EC3 and latest cybercrime trends and threats, Use and abuse of cryptocurrencies, Cryptocurrency investigations and strategic investigations, Blockchain, OSINT and the Europol on-the-job experience.

Europol’s tweet about Day 5

Day 6

Day 6 at ICSSS 2019

Useful to know about day 6:

The subject tackled in the keynotes of the morning were the following: short briefing on the concept of the Dutch Innovation Factory, Cyber Security activities within an international context. Also, Dr Rutger Leukfeld made a lecture about The Human factor in cybercrime and Peter Janssen presented Cybersprint.

Dutch Innovation Park’s tweet about Day 6

Summary of ICSSS 2019 in pictures

ICSSS 2019 summary in pictures

Why should you attend ICSSS ?

  • ICSSS gives a holistic point of view of cybersecurity. We had ethical hacking workshops and also tackled subjects as various as: laws, policies, cyber resilience, crypto currencies, …
  • Meet people from all over the world (this year 22 different countries). But also a great panel of different backgrounds from technical to legal.
  • The lectures were made by renowned University professors but also by experienced professionals from different fields (private and public sector).
  • Don’t hesitate to apply your motivation will lead you the way! This experience is a once in a lifetime.

To go further

Learning Expeditions in Israël

After having an opportunity to go in Israël for a first learning expedition in 2015, i went back last july (2019). Israël is known to be one of the best startup nation. I am going to share with you my experiences: one in the field computer science and the other in cybersecurity.

SheCodes, Tel Aviv (2015)

SheCodes @ Campus Tel Aviv

The first time i went in Israël i was able to attend one of SheCodes meetup. They presented the different workshops: from basics of web programming to more advanced programming. In these workshops everyone is welcome no matter which level. You will get to learn by doing and be able to ask questions to other attendes or to the mentors.

If you have the opportunity to attend an event made by SheCodes, you definitely should do it, and if you live in Israël you should attend all of them. Since 2015 they even grew they are not only in Tel Aviv anymore but also in Jerusalem, Herzliya, Netanya, … Click here to get more info on their website.

Technion University (2015)

Technion, Dream it. Do it

During this learning expedition, i scheduled a visit of Technion University. If you want to do the same, you will have to contact them and provide them a short bio and a brief explanation of why you want to visit. Then, they will help you schedule a guided tour of the University.

Technion is among the world top ten science and technology research University. You can read the full history of this University here. Also, by going to Technion you will have the opportunity to visit the breath taking city of Haifa. Why not taking a snack break at Fattoush?

Fattoush restaurant

After this go and chill out at Bahaï gardens!

View of Bahaïa gardens

BSides Tel Aviv 2019

BSides TLV 2019

Workshop – Ethical Hacking 101 (July 2019)

For the first day of the Cyber Week of Tel Aviv I attended a workshop hosted by BSides Tel Aviv: Ethical Hacking 101 by Telspace Systems.

After a brief introduction on Ethical Hacking, we were able to practice a little. We used different scanners and tools. There were different environments set up just for us to hack them. We got the opportunity to practice SQL injections, vulnerability scanning, vulnerability exploitations. We saw the full process of pentesting, from looking for vulnerabilities to exploiting them with tips and tricks to stay stealthy while doing so. They also presented a very useful tool, really worth mentioning here: CherryTree. With this you can take notes about your process, this will make the pentest report easier to produce in the end.

This class was an awesome introduction to ethical hacking. The instructors were very clear and passionate. If you have the opportunity to attend a BSides meetup you should totally do it.

Talks

The day after the workshops, BSides had organized different talks. They were presented by Keren Elazari, Security Analyst, Author and TED Speaker. There was also a special tent for BSides where you could see their partners. There was an area if you were looking for a job and one just to chill out. I need to add a special mention to the decorations of the stage and the posters. They were awesome! You can see the picture below.

Eva Galperin: Where do we go from here, fighting Spouseware and Stalkerware

Eva Galperin is Director of Cybersecurity at the Electronic Frontier Foundation.

The main points in her talks were the following:

  • Stalkerware and Spouseware are not detected by anti-virus
  • She conviced Kaspersky to help with the detection of those apps and take privacey seriously
  • The tools to fight against this exist
  • Laws that already exist need to be enforced
  • She is shouting out for people to talk about this.

If you scroll down you will find in the « To go further » section a link to a video of her talk.

Amichai Shulman and Yuval Ron: Alexa and Cortana in Windowsland

They presented different vulnerabilities they found in Cortana and Alexa on windows operated devices.

In the « To go further section » you will find the youtube Channel of Yuval Ron in which you can find some demos.

Sofia Belikovetsky: The Butterfly Effect Actively manipulating VW through hypervisor introspection

Sofia Belikovetsky took the challenge to create a virtual router in order to find anomalies in the network. In this talk she explained how she proceeded to do this: How she was able to find what was going on in the VMs from the outside (from a list of running processes to a monitor of every new processes).

Tomer Zait and Nimrod Levy: ReDTunnel, Explore Internal Networks via DNS Rebinding Tunnel

Tomer Zait and Nimrod Levy presented ReDTunnel how it works and why they created it. In the « To go further » section you will find a link to ReDTunnel Github, why not contribute?

Yossi Sassi: PowerShell as a Hacking Tool

Yossi Sassi shared many tips to get the best of PowerShell as a hacking tool. In the « To go further » section you can find a link to his slides and… a link to Yossi Sassi & The Oriental Rock Ochestra.

Omri Misgav: Bypassing user-mode hooks 101

Omri Misgav is the team leader of the security research team of Ensilo. In this talk he explained hooking and user-mode hooks.

Yaron King: Low hanging (blue) fruit, Hacking and defending yourself using open-source tools

Yaron King explained how he got confronted to password spraying and what he did about it.

Eyal Itkin: Karta Source code assisted Geographic-based binary matching

Eyal Itkin is a vulnerability researcher at Check Point Research. In this talk he explained how Karta works. In the « To go further » section you can find Karta Source code.

Danny Grander and Yuval Ofir from Pasten CTF Team: Capture the Flag

In their talk Danny Grander and Yuval Ofir explained what a CTF is and their experience with them. They also presented how they resolve hard challenges.

Other events of the Cyberweek 2019 in Tel Aviv

Besides BSides (yeah i know xD ), there were plenty of events during the cyberweek. I went to some of them that i will present here.

Women in Cybersecurity: How to attract more diverse talent

Leading Cyber ladies invited inspiring women in. Firstly, Keren Elazari interviewed some of them. They shared their experience and gave some advices :

  • Hila Meller, VP Security Europe British Telecom. Her advice: if you want it don’t let anyone stop you. Believe in yourself
  • Helen Dixon, Comissioner, DataProtection Comission, Ireland. Her advice: Don’t listen to any advice you are perfect as you are
  • Maria Thompson, Chief Risk Officer State of North Carolina. Her advice: Learn foundations of IT if you are able to achieve and do that you will be more successful.

After those interview Eva Galperin, Director of Cybersecurity and Head of Threat Lab, Electronic Frontier Foundation, presented herself and her career in a brief talk.

Finally, there was a panel moderated by Reut Menashe, co founder of BSides TLV.

Each person from the panel presented their background. Then they shared what and why in their opinion companies should do more to attract more talent.

  • For Limor Kessem, mono culture has a bad effect. She also said that there is an impact on diversity with the « bring a friend policy ». In fact, with this kind of policy companies tend to hire the same kind of people.
  • For Mary McGinley, companies need to have an extremly diverse team to see all aspects of a problem. She reminded the study that said that women won’t apply to a job if they do not fit 100% of the criterias. She advises that even if many people tell you that you should not apply, apply anyway. She added « do something you love and make it work for yourself ».
  • Karine Ben-Simhon, said that it’s important to encourage private and public sector to make equal opportunities. She also said that there is also a problem with women because most of HR staff are women.
  • For Moran Weber, the best way to make a difference is by combining top down and bottom up approach. It’s also important to revise the job description and understand why women don’t apply. In her opinion those descriptions should avoid terms like « ninja code », « superstar », « rockstar », etc. She shared that her best decision was to start putting herself out there and to decide that her imposter syndrom would not decide for her. She used it to help her learn more.

Plenary talk CyberWar is the continuation of politics by other means: interview of Stevan Bernard by Keren Elazari

CyberWar is the continuation of politics by other means

In this interview Stevan Bernard explained how the attack on Sony Pictures of november 2014 was handled. Here are the main points he shared:

  • Never underestimate your enemy.
  • Decisions made on Day 1 are the decisions that saved the company. This day was all about global and big decisions. This is when they decided to call the FBI and cyber security companies.
  • The human link is the weakest link: the attack started with spear phishing.
  • With twelve thousand employees all over the world, in such attack, you need to find alternative ways to communicate: Sony used old blackberry phones.
  • You can’t prepare enough: hire the right people, make the right decisions, get every one on the same page and define roles and responsibilities.

FraudCON 3.0

Stage of FraudCon 3.0

This event was a full day event. All along the day awards for « Legends of fraud fighting » were given and the winners shared their experience. I am going to present some talks of the day.

Limor Kessem, executive security advisor at IBM opened the day. She made an iventory of the last few years in terms of malwares and presented some of them. After her introduction different talks were given.

Ori Wainshtein: Thinking beyond traditional fraud

Ori Wainshtein is Head of Risk Research and Intelligence at Intuit. After a presentation of Intuit, he explained that in his opinion we need to be able to educate our children about this. He presented different aspects of fraud prevention and some scams. To conclude he gave key advices: Invest in customer safety, optimize for brand protection and develop holistic point of view on fraud.

Panel: news from the kingdom

Panel news from the kingdom

In this panel participants shared the lancaspe of UK in terms of fraud. Some figures were presented: reported fraud increased by 6% since 2009. Indentity fraud has been the biggest issue for a while and in 2018 it is more than ever, 85% of it is perpetrated online. They also tackled the issue of fraud detection and how to detect it.

Panel: tales from the colonies

Panel tales from the colonies

In this panel, they started to talk about mobile attacks saying that the minute something is patched, something new is out. Companies have to make things safer without changing too much the customer experience.

Nadav Katzenell: Remote overlay trojans attack and detection

Nadav Katzenell is head of ecurity researcher at IBM Security. In this talk he explained Remote overlay trojan attack. It is an attack that originated in Brazil and then quickly expended in South America and to new industries. Then he explained how his team set up a solution to detect this kind of attack.

Yehonatan Bar-Lev: The power of fusion center

Yehonatan Bar Lev is head of Cyber Center at the Bank Hapoalim. Yehonatan Bar Lev showed us the organization of a drug ring from the inside. What skills they have, how they work, how they hire staff and what type of attack they launch.

Mirko Manske: A sunday in hell

Mirko Manske is a federal criminal police officer in Germany. In this talk he explained how his team and him confronted an internet « provider from hell » to collaborate with them on a special case. He gave us an inside view of how german police and prosecutors work on such cases.

Panel ecommerce fraud, the next generation

Panel ecommerce fraud, the next generation

In this panel, Noa Kind started to explain what Ad Fraud is and how it was countered. Then, other persons from the panel explained how consulting works.

Karisse Hendrix: fighting online fraud is a lot like fighting zombies

Karisse Hendrick is an eCommerce Chargebacks & Fraud Consultant. In this talk she explained how online fraud evolved and her insights as a consultant. She also co-host a podcast that you can find in the « to go further » section.

Spencer McLain: Fighting fraud with collaboration

Spencer McLain is Vice President at Ekata. In this talk he first explained that online sales are increasing in order to tackle the authorization rate and fraud problem. He showed how fraud and solutions to fraud evolved, he gave a holistic approach to fraud prevention.

Sergey Shykevich: Even idiots can do fraud

Sergey Shykevich is cyber threat intelligence team manager at Q6 Cyber. In this talk, Sergey Shykevich explained that even with very basic knowledge anyone could do fraud. To prove his point he even showed an example.

Raymond King: Robbing the digital train

Raymond King is a product manager at TransferWise. In this talk, firstly he presented TransferWise. Then he explained to what kind of fraud TransferWise is confronted and the consequences it has and how they prevented them.

Ethan Ram: Fraudulent App installs

Ethan Ram is VP R&D at ZoomD. In this talk he explains what is App Install Fraud, how it works and how to fight it.

Panel: What’s new in marketplace fraud

Panel: What’s new in marketplace fraud

In this panel, they all shared their insights from their different companies. Firstly they shared the kind of fraud they are confronted to. Then they gave their opinions about machine learning and artificial intelligence to detect fraud. They talked about the collaborations they have with other platforms in the marketplace. Finally they shared some advice to fraud fighting teams.

To hapilly finish the day at FraudCon we did a fun little game in which we had to define if the case presented to us was « friendly fraud » or « true fraud ».

Conclusion

Learning expeditions are a really good way to learn. You get to see different things and discover the world at the same time. The CyberWeek was an awesome experience, i really enjoyed the talks and got to learn a lot. If you have the opportunity to go to the CyberWeek you definitely have to go to BSides TLV and FraudCon.

To go further

Hackeuse pour la DGSE – Challenge Richelieu

Afin d’étoffer ses équipes la DGSE a organisé un challenge: le Challenge Richelieu.

Pour y accéder, il fallait se rendre sur le site https://challengecybersec.fr/ :

Page d’accueil du challenge Richelieu

Et c’est tout! A moi ensuite d’enquêter…

Premier réflexe donc, ouvrir la console web et regarder le code source de la page et là j’ai découvert l’existence d’un fichier PDF:

Code source de la page d’accueil du challenge Richelieu

J’accède au fichier en tapant dans le navigateur à la suite de l’adresse « /Richelieu.pdf » pour ainsi obtenir ce qui semblait être un fichier PDF de 364 pages avec un texte noir sur fond blanc à la première page:

Première page du PDF

Mais comme je ne suis pas dupe j’ai fait une sélection de tout le document:

Sélection sur le PDF

Et bien sur du texte était caché. J’ai donc sélectionné tout le texte et collé dans mon notepad préféré.

En voici un extrait:

/9j/2wBDADIiJSwlHzIsKSw4NTI7S31RS0VFS5ltc1p9tZ++u7Kfr6zI4f/zyNT/16yv+v/9//// ////wfD/////////////wgALCA20CD4BAREA/8QAGQABAQEBAQEAAAAAAAAAAAAAAAECAwQF/9oA CAEBAAAAAeFzUWUsiyzUFlgFgChLKud5lms2KluaLBNZs1neNSaRclSxqWLJ0xYVNQFyusxQlA1M 6iyhNRKQrUpCxKuNJqUEqyywmoIosUgmosZ1nSWxYlzbOYEWFlRZQssFlRUAqWGsgsspc6zZUsqW WWagXNlihKCywVZcrLZLYWLEspYssRalJqEmpTQzqCaSNXNualoEUzKQVQlSiklslFRKOUosLIai UlAChFhYohYCoVc6ksAsLLKSyzeNSakWwlsBSyClipKAlSpZpJSrJRFllKVneUpVzVkVFTUsLCFm kmoiyiWS1c0SyWrOVyssoRUsompYAVLBUqxLKlslhZUqUAJqWCWakqWWazpEtgsazrNlhYsti5qw WLBYWWxYljWRZWpWdJrnbc3UzaSqlSasiTSaJYkprNhYaixE1E05AlslRUsUlqFgssBZZZvBYsWL LNZVKjWbYJVkoubFE1JaRYllUSglJSahYm8ypVlCpYGsakVUq5E3Gue7lTNUsubFShYSoWWGoms6 ksKLnTiWSy2EUhZqShQRZrJYUiywssLLCpSW51C53m5KQqVKsWEsosVKXO8zeLLWaWNZ1JZYWVKs lJbnebnSWoE0lzpBQEhbGksAiy3G2dsyqZtzpmiuIssRSWLLYSgWWak1lYsssLLFJUWWGs2LNQJr OoItiW5WazU1BUCWoq5azSaRNSxrIsCxUbzYJrO83OmkY3Cpc6li5usXRLjZmhQICbxTNLqZ1mxL Y1eFgLJUoRbE0lgKgApc2VBUDWSzWVEqFSypbmhNSy5sqazSVrKoFiwtzZWsrKiakpZUVLKudZ1n 

J’ai reconnu un encodage de base64. J’ai ensuite décodé ce texte et testé un « strings » sur le fichier :

Strings sur le fichier décodé
Résultat de la commande

J’ai ainsi obtenu une liste de fichiers et un mot de passe.

Il y a donc des fichiers inclus dans le PDF. Je vous passe mes recherches approfondies sur les structures des PDF (je vous renvoie vers les liens de fin d’article si vous souhaitez en savoir plus, je vous y invite vivement car c’est passionnant).

Il est également intéressant de noter que si l’on renomme le fichier en jpg on obtient une image:

Renommage du fichier en jpg

Répondant maintenant à la question que l’on est amené à se poser, en tout cas que je me suis posée longuement en ce qui me concerne. Comment dois-je faire pour récupérer les fichiers et les extraire? Il existe un outil très pratique pour ceci: binwalk

Résultat de binwalk

Binwalk affiche tous les fichiers que l’on nous avait promis, c’est bon signe! Je vais pouvoir les extraire grâce à l’option -e

Ici mon fichier s’appelle base64.jpg, binwalk va créer un dossier _base64.extracted et y mettre tout ce qu’il aura pu extraire:

Résultat de binwalk -e

Voici le contenu du dossier créé par binwalk:

Résultat du ls dans le dossier créé par binwalk

J’ai ensuite tenté de dézipper le fichier 6CCBC.zip (le mot de passe du zip est celui trouvé précédemment dans le base64:

Mot de passe
Dézippage du fichier et récupération des fichiers

J’ai donc récupéré les fichiers et leur contenus.

Contenu et taille des fichiers que l’on vient d’extraire

Il est important de noter à cette étape qu’en voyant les fichiers obtenus et leur noms, il m’a semblé que j’allais devoir cracker une clé RSA… Je dispose en effet d’une clé publique « public.key » et d’un étrange fichier « prime.txt ».

Je me suis donc attaquée à la compréhension du .bash_history. En connaissant un peu Linux on peut savoir que le .bash_history contient l’historique des commandes tapées. J’ai donc fait un cat sur le fichier pour savoir ce qui a été tapé pour créer les fichiers.

Cat sur le fichier .bash_history

Je remarque plusieurs utilisation de la commande sed qui fonctionne avec des expressions régulières. Une petite recherche m’a permis d’en savoir plus:

The sed General Syntax

Je comprends que prime.txt est une clé RSA mais qu’elle a été modifiée avec la commande sed.

Voici ce qui a été effectué grâce à sed:

// 7f a été remplacé par fb sur tout le document
 1342  sed -i ‘s/7f/fb/g’ prime.txt

// e1 a été remplacé par 66 sur tout le document 
 1343  sed -i ‘s/e1/66/g’ prime.txt

// f4 a été remplacé par 12 sur tout le document
 1344  sed -i ‘s/f4/12/g’ prime.txt

// 16 a été remplacé par 54 sur tout le document
 1345  sed -i ‘s/16/54/g’ prime.txt

// a4 a été remplacé par 57 sur tout le document
 1346  sed -i ‘s/a4/57/g’ prime.txt

// b5 a été remplacé par cd sur tout le document
 1347  sed -i ‘s/b5/cd/g’ prime.txt

Ici il faudrait donc taper les commandes à l’inverse pour retrouver le fichier d’origine.

Je vais maintenant essayer de comprendre en quoi consiste la commande : openssl rsa -noout -text -in priv.key | grep prime1 -A 18 > prime.txt

Grâce à une recherche j’apprend ceci:

Openssl

Cette commande permet donc juste d’afficher la clé privé.

J’ai eu quelques difficultés sur cette partie du fait de mon manque de connaissances en cryptographie.

J’ai donc fait des recherches afin de continuer car j’étais curieuse de savoir sur quoi cela allait déboucher. J’ai pu trouver le mot de passe pour décompresser suite.zip.

Ce zip contenait un fichier texte avec des informations nécessaires à la continuation du défi.

Il était possible de se connecter en ssh à un serveur dédié au challenge.

Suite du challenge

On passait ensuite sur la partie Wargame du challenge.

Connexion en ssh au wargame richelieu

J’ai un peu joué avec le défi 1 mais j’ai malheureusement manqué de temps pour finir les défis. En manipulant un peu le défi 1, j’ai compris qu’il s’agit d’un buffer overflow à exploiter.

En effet voici le résultat d’un ls -al :

Commande ls -al

Je n’ai évidemment pas les droits nécessaire pour faire un cat sur « drapeau.txt ». Je sais que je peux exécuter le programme grâce aux droits que j’ai a sur prog.bin : -r-sr-sr-x

Je l’ai donc lancé et j’ai pu m’amuser un moment avec les différentes options… Fun fact: avec l’option 3 j’ai vu devant mes yeux ébahis un petit train qui passait sagement:

Petit train express DGSE

Le principe ici était d’exploiter le buffer overflow pour faire des commandes réservées à root. En effet, j’avais noté la présence du « s » sur le programme prog.bin. Ce « s » permet à l’exécutable d’effectuer des commandes que le propriétaire du fichier aurait pu faire. C’est grâce à ceci que j’ai pu en apprendre plus sur la fameuse attaque: « return oriented programming ». En exploitant cette attaque j’aurais pu essayer de faire faire un cat drapeau.txt par le programme.

Note importante: Grâce à Geluchat sur Twitter j’ai appris que la démarche était bien plus simple que ce que j’imaginais pour le défi 1 du wargame:

Voilà donc mon expérience sur le challenge Richelieu. J’ai beaucoup aimé parce-que j’ai appris énormément sur les pdf et j’ai pu découvrir la return oriented programming attack. Je trouve important de noter que même si l’on ne peut pas ou l’on a pas forcément le temps d’aller au bout des défis on apprend énormément même en y conscrant peu de temps.

Je vous invite donc si vous avez l’occasion à faire le prochain défi proposé par la DGSE, qui sait, vous serez peut-être embauchés!

Pour aller plus loin

Compte rendu de la participation de WoSEC Paris au Spying Challenge de LeHack 2019

Scroll down for english version

Teaser du Spying Challenge de LeHack 2019

Dans le cadre des activités du WoSEC Paris, j’ai créé une équipe de CTF pour le Spying Challenge 2019 de la conférence LeHack à Paris.

Logo du Spying Challenge

Qu’est-ce que le Spying Challenge ?

Pour cette troisième édition lors de « leHACK » et dans un contexte d’intelligence économique omniprésent, vous aurez comme mission de collecter des informations sur un ensemble de cibles avec pour but de satisfaire vos clients floués.

Cette mission fera intervenir des recherches en sources ouvertes, du vishing, de la filature, du social engineering, des intrusions physiques, du lockpicking, etc.

Comment ça marche ?

Une première épreuve de qualification avant « leHACK » permettra de départager les meilleures équipes qui pourront continuer l’expérience. C’est dans un second temps, le 6 juillet, que vous serez dans l’action réelle !

(source: https://spyingchallenge.com/edition-2019/)

Les phases du Spying Challenge

Phase 1: OSINT, GEOINT, Social Engineering et rapport

Les agents Dupont et Martin ont fait appel à des agences dont WoSEC Paris afin d’enquêter sur une entreprise suspecte, voici l’ordre de mission (mail et PDF joint décrivant l’objectif de la mission) :

Présentation des agentes du WoSEC Paris

Christine Granville aka @Gabrielle_BGB

Agente Granville

Ash aka @asdmhx

Agente Ash

Lucy Elizabeth Smith @catr42

Agente Smith

Pour être sélectionnées, il nous fallait réussir cette phase qui consistait à écrire un rapport documenté sur nos démarches telles que de l’OSINT, du GEOINT et du social engineering par téléphone ou par mail/chat.

Extraits du rapport

Voici le rapport que nous avons soumis aux agents Dupont et Martin:

Voici également l’enregistrement de l’appel de l’agent Ash à Lictor (le lien dans le rapport n’est plus valide):

Mail de sélection pour la phase 2

Nous avons été reçues pour passer aux phases suivantes que je vais ici vous décrire.

Phase 2: Le Spying Challenge Physique à LeHack Paris

Avant de commencer cette phase, nous avons reçu un e-mail avec de plus amples informations sur le déroulement de la mission:

Mail de description de la phase 2

Pour décrire la phase je vais présenter chaque mission qui nous ont été confiées tout au long de la journée.

1. Interagir avec le maximum d’interlocuteurs employés par Lictor afin de récupérer de nouvelles informations sur vos cibles.

Equipées de micros, les agentes ont rapidement repéré le stand de Lictor.

  • Ash portait un t-shirt Spartan et a du aborder Liliana (Ingénieure d’affaire chez Lictor) ;
  • Granville s’est fondue dans la salle pour arriver incognito au stand de Lictor et intéragir avec les différents employés ;
  • Smith joue le rôle de la stagiaire en recherche d’un poste stylé et aborda Lictor pour en savoir plus sur leur actions.

2. Identifier et prendre en photo l’employé Jack Barrel

Opération toujours en cours…

3. 11:35 am Rencontre avec le PDG de Lictor

A cette étape de nouvelles missions (en temps limité) nous ont été confiées:

  • Faire du Social Engineering sur le PDG de Lictor afin d’obtenir plus d’informations sur lui (effectué par l’agente Ash) tout en faisant diversion.
  • Récupérer discrètement le sac du PDG afin d’échanger un CD et de prendre un maximum de photo du contenu du sac (effectuée par agente Smith et agente Granville)

4. Neutralisation et fouille

Lors de cet entretien, on nous a confié les missions suivantes:

  • Les employés de Lictor ayant découvert que l’agent Dupont était sous couverture, ils décidèrent de l’éliminer. Pour les stopper, l’agente Smith eu pour mission d’empoisonner le verre de l’employé chargé de la neutralisation de l’agent Dupont.
  • Une salle suspecte certainement équipée de micro devait être fouillée à l’aide d’un détecteur. La salle étant sous surveillance, il fallait que l’agente Ash fasse diversion afin que l’agente Granville puisse entrer pour fouiller la salle et détecter les micros. Des employés surprirent l’agent Granville pendant sa fouille elle a du utiliser ses talents de persuasion pour ne pas éveiller les soupçons.

5. Filature

Lors de cette phase il était question de suivre les employés de Lictor qui avaient kidnappé Gustave Leproleau. Il s’agissait donc de retrouver l’endroit ou était enfermé Gustave. Les agentes ont procédé à différentes filatures et ont identifié la cachette ou était enfermé Gustave Leproleau.

6. Libérer Gustave

Pour la dernière nous devions libérer Gustave. Toutefois, nos plans ne se passèrent pas comme prévu. En effet une horde de sbires cagoulés et tout de noir vêtu nous ont poursuivi et enfermé séparément.

L’agente Ash et l’agente Granville, furent enfermées dans une salle. Menottée, l’agente Granville utilisa sa pince à cheveux pour se libérer. Les mains liées, l’agente Ash réussit à casser le filament de plastique afin d’ouvrir le coffre fort ou étaient dissimulées des informations TOP SECRÈTES.

Pendant ce temps, l’agente Smith subit un interrogatoire musclé qui ne l’impressionna pas du tout.

Les élites de la France selon l’équipe du Spying Challenge

WoSEC Paris: gagnantes du Spying Challenge 2019, LeHack Paris

Nous avons honoré notre mission en libérant Gustave Leproleau des griffes de cette entreprise peu scrupuleuse.

Agente Smith, Gustave Leproleau, Agente Granville, Agente Ash (sous le beau logo WoSEC)

Classement du top 3:

WoSECParis première place!
SpyKidsIH3 deuxième place
Project BlueBird troisième place

Les Rankings successifs de la journée

Ranking OSINT et phase de SE
Ranking phase 2 (SE, document theft, poisoning and surveillance)
Dernier ranking (lockpicking, lie detector, escape)

Tweet du Spying Challenge sur notre victoire

Write-up officiel de l’équipe WoSEC Paris

Remerciements

Merci à @asdmhx et à @catr42 pour leur enthousiasme et leur détermination!

WoSEC Paris remercie l’équipe du Spying Challenge pour l’organisation de ce palpitant challenge et les mise en situation réaliste lors de LeHack.

L’équipe du Spying Challenge

Merci également à tous les participants du Spying Challenge de nous avoir donné du fil à retordre.

Enfin, un grand merci à LeHack d’hoster un tel évènement.


Report on WoSEC Paris’ participation in the Spying Challenge of LeHack 2019

Teaser of Spying Challenge of LeHack 2019

As part of the activities of WoSEC Paris, I created a CTF team for the Spying Challenge 2019 of LeHack conference in Paris.

Logo du Spying Challenge

What is the Spying Challenge?

For this third edition during the “leHACK” and in a context of omnipresent economic intelligence, you will have the mission to collect information on a set of targets with the aim of satisfying your customers.

This mission will involve open source research, vishing, tracking, social engineering, physical intrusions, lockpicking, etc.

How does it work?

A first qualifying event before “leHACK” will allow to decide between the best teams who will be able to continue the experience. It is in a second time, on July 6, that you will be in the real action!

(source: https://spyingchallenge.com/en/2019-edition/)

The phases of the Spying Challenge

Phase 1: OSINT, GEOINT, Social Engineering and report

Agents Dupont and Martin called different agencies including WoSEC Paris to investigate a suspicious company, here is the mission order (email and PDF attached describing the objective of the mission):

Presentation of the agents of WoSEC Paris:

Christine Granville aka @Gabrielle_BGB

Agent Granville

Christine Granville, a social engineering enthusiast, is very persuasive. When she was a baby, she hacked the exit code from her mother’s womb. As a child, lockpicking was her favourite extracurricular activity. Today at the WoSEC Paris agency, nothing can resist her, her two favourite sidekicks (Ash and Lucy Elizabeth) and she are in charge of the most dangerous missions.

Ash aka @asdmhx

Agent Ash

Iron fist in a velvet glove, Ash has always known how to distinguish herself by her taste for fighting and high-risk excursions. Her passions in life: knee breaking and videos of axolotl babies. She recently joined the WoSEC Paris team to use her social engineering skills – and also to learn how to pull the worms out of a source without having it end up in an IKEA kit.

Lucy Elizabeth Smith

Agent Smith

Passionate since her early childhood about puzzles, investigations, coded messages and everything that makes knots in the brain, Lucy decided one day to put her talents at the service of the WoSEC Paris agency.

To be selected, we had to succeed in this phase, which consisted in writing a documented report on our approaches such as OSINT, GEOINT and social engineering by phone or email/chat.

Extract of the report

The report is available only in french

Mail for our qualification for phase 2

We had been qualified to move on to the next phases that I will describe here.

Phase 2: The Physical Spying Challenge at LeHack Paris

Before starting this phase, we received an e-mail with more informations about the mission:

Dear agents,

Reading your report convinced us of your ability to
collect relevant information. Your feedback has allowed us to
make great progress in our investigation of Lictor.
As indicated above, we have therefore decided to keep you on
this mission which will continue on July 6, 2019.

Between 10am and 12pm, you should:

  • Interact with as many people as possible employed by Lictor in order to
    retrieve new information about your targets;

  • Identify and take a picture of employee Jack Barrel (he is strong
    suspicious and only shows up at the stand from time to time);

  • Go to the place indicated in attachments at 11:35 a.m.
    (no delays will be tolerated), where you will have to meet the CEO
    of Lictor, and where you will be informed of your orders for the rest of
    the operation.

If possible, bring back a lockpicking kit, enough to take pictures,
write a report in digital format, and your boldness.
We expect a brief report on your new findings to
1:30pm.

PS: Do not follow or interact with targets until it is
wears a cap with the Lictor logo on it (according to our information, the
CEO of Lictor and Jack Barrel will not wear hats: you
will still be able to talk to them).
Similarly, you will only be able to interact with Gustave Leproleau if
when he wears his beret.

PPS: The service apologizes for the late hour, there was a pot.

Sincerely,

Agents Dupont and Martin


To describe the phase I will present each mission that was given to us throughout the day.

1. Interact with as many people as possible employed by Lictor to retrieve new informations about your targets.


Equipped with microphones, the agents quickly spotted Lictor’s booth.

  • Ash wore a Spartan t-shirt and had to approach Liliana (Business Engineer at Lictor);
  • Granville melted into the room to arrive incognito at the Lictor booth and interact with the different employees ;
  • Smith played the role of an intern in search of a cool position and came to see at Lictor’s stand to know more about their actions.

2. Identify and take a picture of the employee Jack Barrel

Operation still in progress…

3. 11:35 am Meeting with the CEO of Lictor


At this stage we have been entrusted with new missions (in limited time):

  • Social Engineering on the CEO of Lictor to get more information about him (done by Agent Ash) while diverting.
  • Secretly pick up the CEO’s bag to exchange a CD and take as many pictures as possible of the contents of the bag (done by Agent Smith and Agent Granville)

4. Neutralization and search

Agents,

Congratulations, your mission continues.
Meet us at 3:15 pm in front of the Lictor stand to receive your instructions.
Sincerely,

Agents Dupont and Martin

During this interview, we were given the following tasks:

  • When Lictor’s employees discovered that Agent Dupont was undercover, they decided to eliminate him.
    To stop them, Agent Smith was given the task of poisoning the glass of the employee responsible for Agent Dupont’s neutralisation.
  • A suspicious room certainly equipped with microphones had to be searched with a detector. With the room under surveillance, Officer Ash had to create a diversion so that Officer Granville could enter the room to search the room and detect the microphones. Some employees surprised Agent Granville during her search and she had to use her persuasive skills to avoid arousing suspicion.

Agents,

Phase 3 of your mission is not complete. We will meet at 4:30 pm at Lictor stand for a final spinning event. You will receive your orders on site.

At the end of this test, a selection will be made and only the
the best agents will participate in the final phase.

Sincerely,

Agents Dupont and Martin

During this phase, we had to follow Lictor’s employees who had kidnapped Gustave Leproleau. So it was a matter of finding the place where Gustave was locked up. The officers conducted various surveillance operations and identified the hiding place where Gustave Leproleau was locked up.

6. Releasing Gustave

For the last one we had to free Gustave. However, our plans did not go as planned. Indeed a horde of hooded and black-dressed minions chased us and locked us up separately.
Agent Ash and Agent Granville were locked in a room. Handcuffed, Agent Granville used her hair clip to free herself. With her hands tied, Agent Ash managed to break the plastic filament in order to open the safe in which were concealed TOP SECRET information.

Meanwhile, Agent Smith was subjected to a tough interrogation that did not impress her at all.

France’s elites according to the Spying Challenge team

WoSEC Paris: winners of the Spying Challenge 2019, LeHack Paris

We honoured our mission by freeing Gustave Leproleau from the clutches of this unscrupulous company.

Agent Smith, Gustave Leproleau, Agent Granville and Agent Ash (under the beautiful WoSEC logo)

Top 3 ranking

WoSECParis first place!

SpyKidsIH3 second place

Project BlueBird third place

Rankings of the day

OSINT and SE phase ranking

SE, document theft, poisoning and surveillance ranking

Last ranking (lockpicking, lie detector, escape)

Spying challenge tweet about our victory


Thanks

Thanks to @asdmhx et à @catr42 for their enthusiasm and commitment!

WoSEC Paris thanks the Spying Challenge team for organizing this exciting challenge and the realistic role-playing during LeHack.

L’équipe du Spying Challenge

Thanks also to all the participants of the Spying Challenge for giving us a hard time.

Finally, a big thank you to LeHack for hosting such an event.

Nuit de la gestion de crise par les jeunes de l’IHEDN

Le 29 mars 2019 a eu lieu la nuit de la gestion de la crise. Cet évènement est organisé par l’association des jeunes de l’IHEDN. J’ai ainsi pu assister à des conférences et des ateliers (gestion de crise, risques de gestion de crise, Social Room, Création d’un exercice de crise, Exercice de crise sociale)

Inscription et préparation

Cet évènement est très prisé et les places pour les ateliers sont parties en moins de deux heures, il faut donc bien lire le programme et préparer son planning à l’avance. Inscrivez vous à l’avance et restez réactifs aux e-mails pour l’inscription aux ateliers.

La gestion de crise aujourd’hui, Gilles Malié

Gilles Malié, Chef d’Etat Major de la Zone de Défense et Sécurité de Paris

L’évènement a été ouvert par une conférence de Gilles Malié, Chef d’Etat Major de la Zone de Défense et Sécurité de Paris. Gilles Malié a présenté son travail et tenté de définir la résilience. Toutefois, selon lui, il est impossible de promettre la résilience dans la gestion de crise: « on ne sait pas ce qu’est la résilience, on connait seulement l’absence de résilience ».

Voici ci-après un slide permettant de comprendre les missions de Gilles Malié.

Gestion de crise

Il a ensuite évoqué, à titre d’exemples, quelques cas pratiques.

Pour conclure, il a rappelé la difficulté de donner une bonne définition de la résilience et souligné que lorsque trop de personnes s’occupent d’un problème, cela débouche sur une mauvaise gestion. Dans ce type de mission, il faut donc être préparé et rester humble.

Les risques de la gestion de crises, Patrick Lagadec

Lors de son intervention, Patrick Lagadec, a donné des exemples de crises et de la façon dont elles ont été gérées. Il a évoqué les imprévus, les mauvaises préparations ainsi que la gestion d’évènements inédits.

Je vous invite à consulter son site internet qui est fascinant et qui propose ses travaux dans différentes langues. C’est ici.

Atelier: Social Room

Social Room est un outil mis au point par Crisotech pour s’entrainer à la communication de crise via les réseaux sociaux. Crisotech met en place différents outils de formation à la gestion de crise.

Formation à la gestion de crise – Crisotech

Après une brève présentation de Crisotech, l’exercice a commencé. Voici le scénario:

Scénario Starwhite – Crisotech

Et nous voici devant la social room de Starwhite. Un exercice délicat, périlleux et passionnant!

Social Room du Starwhite Explorer – Crisotech

Ce qui était important dans cet exercice, était de bien comprendre la crise, de tenter d’anticiper au maximum, d’établir une bonne cartographie de la situation et bien sûr de rédiger des billets pertinents. En résumé la priorité ici est d’être rassurant et de protéger la réputation de Starwhite grâce à une communication de crise adaptée.

Atelier création d’un exercice de crise, Resiliency

Lors de cet atelier, Resiliency nous a présenté les processus de création des différents types d’exercices de gestion de crise. Voici quelques slides de la présentation:

La notion d’exercice

Celui qui m’a le plus intéressé est l’exercice de terrain. Cet exercice se fait sur de longues durées (36h), il s’agit de s’entrainer à sentir ses limites personnelles et physiques.

Un exercice effectué en Corse a été donné en exemple: Les participants occupaient chacun 4 postes de 6h. L’exercice était découpé en plusieurs phases. Les participants ne savaient pas à l’avance ce qu’il se passerait. Voici une vidéo qui présente cet exemple:

Exercice Resiliency en Corse

Exercice de crise sociale, Patrick Cansell

Cet exercice était très bien ficelé. Toutefois, je ne peux pas en dire trop pour le cas ou vous seriez amené à participer à la prochaine nuit de gestion de crise. Il s’agissait d’un exercice en immersion total ou il fallait déployer des stratégies pour gérer une (ou plusieurs 😉 ) crise(s) en entreprise. Chaque participant avait un rôle et des objectifs à respecter. Bref, un atelier à faire et à refaire 😀

En attendant, je vous invite à vous rendre sur le site de Artem-is

Comme vous avez pu le constater dans cette article, j’ai adoré cet évènement. Je vous invite à consulter le site officiel de la nuit de la gestion de crise si vous souhaitez participer à la prochaine édition.

Pour aller plus loin

My internship at Radically Open Security

One of my goal in this ethical hacker challenge was to volunteer for a GREAT organization. This is what i did with Radically Open Security who welcomed me as an intern for six months.

How did i get this opportunity?

When i started to work in the IT I quickly had concerns about the lack of safety on the Internet.
Therefore, my curiosity and thirst for learning led me to wonder about the construction of a safer cyberspace.
This quest has shaped the type of company I wanted to be involved with. This is when I discovered the existence of ROS (Amsterdam, Netherlands) and Melanie Rieback in a press article.
This initiative was an evidence and in line with the values I want to promote.
Transparency is the central point of this company and its business model is a promise of a better social future.

What is Radically Open Security?

« Radically Open Security is the world’s first not-for-profit computer security consultancy company. We are prototyping an innovative new business model – using a Dutch « Fiscaal Fondswervende Instelling » (Fiscal Fundraising Institution) to provide a commercial front-end that sends 90% of our profits tax-free to a backend foundation (Stichting NLnet) that has supported open-source, Internet research, and digital rights organizations for almost 20 years. The other 10% of our profits will go to an employee profit-sharing scheme, in which the secretary accumulates profit-sharing rights as quickly as the CEO. Additionally, due to our low management/overhead costs, we can afford to pay competitive wages to our computer security consultants.  »
At ROS everybody works remotely.
(source: https://radicallyopensecurity.com/business-model.htm)

Wait! Not for profit?

Yes not for profit! Let Melanie Rieback co-founder and CEO explain this to you:

What service do they offer?

  • Penetration testing, ethical hacks and social engineering
  • Malware reversing and analysis
  • Network monitoring and threat detection
  • Forensics
  • CSIRT and incident response
  • Code audits
  • DDoS Testing
  • Cryptographic analysis
  • Custom R&D Projects
  • Workshops, trainings and mentoring
  • Misc: Embedded, Android and RFID Security

(source: https://radicallyopensecurity.com/services.htm)

What did i do?

Participation in the creation of a Capture-The-Flag (CTF) game

ROS helped to build a CTF for the CyberHeroes week of the non profit organization Cyberworkplace (see my article about the CyberHeroes week here).
The theme of the week was Heroes in cyber, I build a list with many heroes from the cybersecurity world, cryptography and cybersecurity resources.

Observation of pentests

I was added to some pentesting channels on RocketChat a chatroom that was used for communication for work purposes. This way, i was able to peek over the shoulders of pentester and see how they work, how they communicate with the client as the pentests are completely available to the clients from the begining to the end (this is one of the core principle of ROS).

Review of pentest reports

I was able to read and review some pentests reports. This really helped me to see how proper pentest reports are build, what pentesters look for while pentesting and which tools they use.

Improvement of the onboarding manual for new staff members

When i onboarded i was provided with an onboarding manual. As i encountered some little problems to set up my work environment i added some entrees in the onboarding manual in order to help future onboarders who had the same configuration i had.

Creation of a wiki page with relevant onboarding information for new staff members

ROS wanted to improve the onboarding process and provide the onboarders resources and useful informations.
This is why i created a wiki page with many resources for every type of positions (project management, software development, pentesting, …). I also added a section for general informations about ROS.
After the set up of this wiki i invited everyone to contribute and share their knowledge with relevant links like their favorite tools that help them in their tasks, great articles they’ve read, anything they would find relevant.

Submission of a process for improving internal training

We wanted to improve the internal training that is why i created a documentation to propose some ideas on the subject.

Helping a coworker with the use of Gitlabs (Radically Open Security’s file storage system)

One of the other intern was new to Gitlabs. As i had previously encountered Git and worked with it, i was able to provide my help.

Organizing folders in Gitlabs

ROS puts their projects and documentation on an internal Gitlabs system. I updated the organization of the folders.

Use of Pentext and XML

« The OWASP PenText XML documentation project can help your software security company produce offers, reports, invoices and generic documents by offering a well-structured and easy to maintain documenting system you can modify to your liking. »
This tool was created by ROS they open sourced it and made it available on Github.
In order to use Pentext you need to know XML.
I really enjoyed using pentext. XML is really useful and you get to generate great looking documents. This saves a lot of work mainly for pentesting reports but it can also be use to save time on other types of reports.

What did i get from this experience

As I plan to build a company, ROS was an inspiring and innovative model for tomorrow’s companies.
More specifically, I learned how a holocratic system works in a company. This system in which everyone has a place and a voice has been a beautiful discovery.
On a more technical aspect I have used many tools such as Pentext.
Finally, I have appreciated working remotely because it requires a personal work organization that invites to be autonomous and rigorous.

(source cyberheroes week flickr) During the CyberHeroes week i had the opportunity to meet Daan, Steven, Melanie and Anh from ROS.

To go further

CyberHeroes week by Cyberworkplace

During my internship at Radically Open Security, i had the opportunity to help with the building of a CTF made for the CyberHeroes week of Cyberworkplace.
I found Cyberworkplace’s initiative so great that i asked if i could volunteer for the CyberHeroes week. They did not only accepted that i volunteered, but also invited me to come as a participant.

What is Cyberworkplace?

Cyberworkplace is a dutch initiative based in Rotterdam. It « is a non-profit initiative that helps reduce the current shortage of cyber security experts in the labor market and provides much-needed 21st-century skills to vulnerable young people (dropouts/ gamers/students, who lack practical experience in their study programs).
The training/lessons given at Cyberworkplace are inspired by modern teaching methods such as peer-to-peer techniques and project-based learning. » (source: https://cyberworkplace.tech/wat-is/)

What is CyberHeroes ?

« CyberHeroes is a one-week training program that brings together twenty talented youngsters from The Netherlands and New Mexico, USA. Together they will be trained in ethical hacking skills to address current security threats. Over the course of one week they will take on hacker battles, work on CSI-type cyber challenges with local police, study the history of cryptography, learn to fight cyber crime alongside international hackers, and much more. » (source: Cyberheroes booklet)

(source: Cyberheroes flickr)

What happened?

Day 1: Cryptography and Lockpicking

(source: cyberheroes booklet)

Philip Zimmerman made a great talk about cryptography and data protection.
He exposed the evolution of the Internet and the impact it had on privacy.

(source: cyberheroes booklet)

(source: Oscar Koeroo’s slides)

Oscar Koeroo started his workshop by a talk about his work at KPN and how they handled security.
On 2012 KPN got hacked, this year they decided to set up a Security Operation Center to handle better such incidents.
KPN CISO Strategy and policy is made available for everyone here
After this introduction, he started explaining cryptography concepts.
He then detailed RSA encryption.
Finally we practiced RSA encryption and encrypted with our own messages and numbers.
He mentioned a very good tool to help us for the assignments:
Wolframalpha.

(source: Cyberheroes flickr)

We ended the day with lockpicking, now i really want to buy my own lockpicking set! 😀 It reminded me of the video game called Skyrim, except it is much easier with a joystick^^

Day 2: CTF with Radically Open Security

(source: screen of the CTF platform made by Daan Spitz from Radically Open Security)

In the morning, Daan Spitz was introduced and the CTF started.
Daan works for Radically Open Security who sponsored the event and gave a CTF that he made.
In the afternoon, Melanie Rieback CEO of Radically Open Security was introduced she presented ROS and gave a great demo talk about cracking passwords.
We cracked the password « TreeHouse1234 » in less than 33 seconds!
Demo and slides can be found on ROS’s github.

(source: Cyberheroes flickr)

Day 3: On a boat with the dutch Police

(source: Cyberheroes flickr)

On day 3, we spent all day at the Seaport Police of Rotterdam.
We had the opportunity to meet Dirk-Jan Grootenboer, Peter Duin and other great police officers. They presented the Seaport Police and their work.
The Cyber Resilience unit has different goals:

  • Awareness of cyber threats and risks by citizens, corporations and other organisations
  • Know how to act: reactive, preventive, pro-active
  • Work together to share knowledge and new opportunities offered by technology
  • Resulting in continuous growth of cyber resiliency
  • From cyber security to cyber resilience
  • From reactive to pro active thinking and acting
  • Catching the advantages of cyber with an open eye for the risks

(source: Police officers talk)

Then, we had a CSI like challenge and a Police Patrol Boat Adventure. We were able to work on our social engineering skills and see the huge port of Rotterdam (largest in Europe).

On the afternoon, Floor Jansen and Marinus Boekelo joined us to present the Hack_Right initiative and explain the amazing take over of Hansa Market a dark web marketplace.
Hack Right is an initiative to help young hackers who commited a small crime, to get back in the right path and use their skills for ethical hacking.
It consists of 4 modules

  1. Restorative justice: if you commit a crime you break your connection with the victim to repair this boundary you have to do something for the community. In this module, cyber criminals are confronted with the damage and possibly even with the victims.
  2. Training: ethical and legal boundaries
  3. Coaching: personal connection between coach and offender. This involves providing longer guidance to the offender, linking them to someone from the community.
  4. Alternative: indicates the opportunities on the labour market and teaches young people where to develop their talents

(source: Floor Jansen’s talk and Mediawijzer’s article)

Day 4: Cybersprint at The Hague Security Delta and US Ambassador residence

In the morning, we worked on « Make it Smart » Maarten van Duivenbode introduced us to smart objects and how to use them. We were able to program lights and their colors.

In the afternoon, we visited Cybersprint at The Hague Security Delta.
Cynthia Schouten made an introductive talk and gave us a tour of the campus. We visited: Hogeschool Leiden’s IOT lab, we were introduced to a mixed reality tool that aims to train student in forensics with simulated crime scenes

(source: Cyberheroes flickr)

Then, we visited Splendo that introduced us their smart bikelock project for X-bike.

After the tour, Peter van Eijk who works at the municipality of the Hague presented the Hack Den Haag CTF. A CTF to help the city of the Hague to be more secure.
Finally, Soufian El Yadmani made an amazing talk about his adventure to cybersecurity. He explained that he was hired as a cybersecurity analyst at Cybersprint by winning a CTF. His team and him travel to many CTF competitions.
His secret to be a good ethical hacker? Practice, practice, practice!

After our visit to The Hague Security Delta Campus we went to the US Ambassador’s residence for a reception for the Cyberheroes program. There, Peter Hoekstra the Ambassador of the US, Anouk Vos from Cyberworkplace and Charles Ashley III from Cultivating Coders talked.
The Ambassador, is now a proud hacker in a beautiful Cyberworkplace hoodie and the owner of a CyberHeroes medal!

(source: Cyberheroes flickr)

Day 5 and 6: Trip to Leeuwarden, no escape possible 😀

(source: Cyberheroes flickr)

On the last two days of CyberHeroes, we were invited to Leeuwarden for a CTF at the amazing Hacklab.
Leeuwarden is a beautiful historical city in the north of Netherlands that has been European Capital of 2018.
The CTF gave us the opportunity to learn a lot.
After all this hacking we did we had to go to jail… joking we just spent the night in a former prison: Alibi Hostel


But before going to sleep, we took part in a great escape game made by Henk Van Ee founder of Cybersafety4u in which we had to unlock a hacker’s phone.

(source: Cyberheroes flickr)

To conclude this awesome week, we all got a certificate and a CyberHeroes medal.
Needless to way i was very proud to participate and help for this great adventure.
I would like to take the time to thank Radically Open Security (Melanie and Anh) without whom i would not have heard about Cyberworkplace.
Thanks also to Anouk, Nasya and Maria from Cyberworkplace that welcomed me for this week.
They all made an amazing work and i would definetely recommend everyone who has the opportunity to take part in a week like this.
Volunteer or help Cyberworkplace any way you can, they do such an amazing work for students and cybersecurity lovers.

(source: Cyberheroes flickr) Volunteers for the CyberHeroes week: Adelle, Anh, Maria, Anouk, Me, Nasya

To go further:

About the forum / A propos du forum

Note: Le forum n’ayant pas attiré beaucoup de monde, je réfléchis à une autre façon de proposer un échange de connaissances et une entraide ouvert à tou.te.s.

Note: As the forum did not attract many people, I am thinking about another way to offer an exchange of knowledge and a mutual support open to all.

Faire défiler le texte pour lire la version française

A Forum to self-study cybersecurity collectively

A few days ago I published my article in peerlyst about how to create an open education degree for free in cybersecurity. In a comment, someone tackled a very important issue : how stay focused when you study alone online?
Because:

    • you can easily be distracted,
    • We tend to scatter ourselves,
  • It is not always easy to learn alone.

To answer to these questions, i first suggested this very good Mooc by Dr Barbara Oakley (McMaster University, University of California San Diego): Learning how to learn on Coursera.

This Mooc is really helpful to understand the process of learning. You get tips and tricks to learn more efficiently.

I also answered that what helps a lot is to make lists of objectives. For instance you can make a list of things to achieve for the day, the week or the month.
The most important thing is to define what you want to learn and where you want to go. Then write it down as objectives you’ll like to fulfill in the end at a certain time pace.


And to break the loneliness while self-studying, I decided to create a forum to gather people who want to learn collectively. It is a place open to everyone who want to learn and share knowledge no matter your age, gender, level, country and so on.

In brief it is a forum that can be use to learn a specific subject or lookup for an answer when you tackle an issue.

picture of the forum


Here is a picture of the forum as it currently is. It is not it’s final look, it will evolve with users and their needs.

As you can see there is an english and a french part for now.

If you speak another language you can ask me to add a category. This would open the forum even more to everyone no matter where they live and which language they speak.

private part for women

This part is only for women or people who identify as women to feel more comfortable learning together. This part is private and you need to ask me the access for it.


Feel free to make this forum a place where learning is free and open to everyone. Learning with peers and meeting for a specific topic or Mooc would be easier to achieve.

Finally, people from the industry and experts are welcome to share their experiences and build a community for open education in cybersecurity.

So let’s build a safe internet by learning together cybersecurity.


Un forum d’auto-apprentissage collectif pour la cybersécurité


Il y a quelques jours, j’ai publié un article sur peerlyst pour décrire le processus de création d’une formation complète en cybersécurité. Dans un commentaire, une personne a évoqué un point important: comment rester concentré lorsque l’on apprend seul?
En effet:

  • On est facilement distrait
  • On peut avoir tendance à se disperser
  • Et ce n’est pas toujours évident d’apprendre seul

Pour répondre à ces questions, j’ai d’abord suggéré l’excellent Mooc du Dr Barbara Oakley « Apprendre à apprendre » sur Coursera (disponible sous titré en français).

Ce Mooc est vraiment très intéressant pour comprendre le processus d’apprentissage. Vous repartirez avec des outils et des astuces pour apprendre de façon plus efficace.

J’ai ajouté qu’il était utile de faire des listes d’objectifs. Par exemple, vous pouvez lister vos objectifs pour la journée, la semaine ou même le mois.

Le plus important, c’est de bien identifier ce que vous voulez apprendre et vers quoi vous souhaitez vous diriger. Ecrivez ensuite cela sous forme d’objectif à accomplir dans un délai prédéfini.

Aussi pour casser la solitude que peut parfois apporter l’auto-apprentissage, j’ai décidé de créer un forum pour réunir les personnes qui souhaiteraient apprendre collectivement. Il s’agit d’un espace ouvert à tous ceux qui veulent apprendre et partager leur connaissances quels que soit leur niveau, leur âge, leur genre, leur pays, etc.

En bref, c’est un forum qui peut être utilisé pour apprendre un sujet spécifique ou répondre à une question lorsque l’on rencontre un problème.
visuel du forum
Voici une photo du forum tel qu’il est. Ce n’est pas son aspect final, il évoluera en fonction des utilisateurs et de leurs besoins et envies.

Comme vous pouvez le voir il y a pour le moment une partie en français et une partie en anglais.

Si vous parlez une autre langue vous pouvez me contacter pour ajouter une catégorie pour cette langue. Ceci permettra d’ouvrir le forum plus largement.
forum privé réservé aux femmes
Cette partie est pour les femmes ou les personnes s’identifiant au genre féminin afin de se sentir plus à l’aise et d’apprendre ensemble. C’est une partie privée pour laquelle il faut me demander un accès.

N’hésitez pas à faire de ce forum un endroit ou l’apprentissage est gratuit et ouvert à tous. Apprendre avec ses pairs ou se rencontrer pour échanger sur certains sujets sera facilité.

Pour finir, les professionnels et experts sont les bienvenus pour partager leur expérience et construire une communauté d’apprentissage ouverte pour la cybersécurité.

Allez, construisons un internet sécurisé en apprenant ensemble la cybersécurité!

Ressources / Resources

Scroller un peu pour la version française

To go further in my challenge, I have built a panel of open resources.
The collection of these resources was done progressively, I looked up French and foreign university programs, job descriptions in cybersecurity but also unconventional profiles that I had the opportunity to meet.
Indeed, my last six months have been punctuated by Moocs, CTF, a summer school, cybersecurity conferences and job interviews.
The adventure continues with an internship in which I will have the opportunity to test this knowledge.

I wanted to share the results of my research here in order to give other people the opportunity to be able to train themselves.
This page is divided into several parts:

– « Moocs » on specific topics,

– « Webinars » and « videos » for a more visual format,

– The « books, reference articles, tutorial sites, associations, conferences and useful blogs » section provides resources to turn to, in different subjects, to complete the learning of Moocs.
It also contains a list of very specific conferences that I found on Wikipedia and for women a list of women’s communities in cybersecurity,

– Finally, the CTF and games part allows you to put it into practice and offers moments of relaxation.

Not all links are completely free, but I have tried to find resources that are at least partly free and open for everyone to use.

Feel free to comment if you have other references or events (workshops, bootcamp, summer school,…) around the world.

Please help me to complete my list of women in cybersecurity communities if you know any.


Pour avancer dans mon défi, j’ai construit un panel de ressources ouvertes.
La collecte de ces ressources s’est faite au fil de l’eau, je me suis imprégnée des programmes universitaires français et étrangers, des fiches de poste dans la cybersécurité mais aussi des profils non-conventionnels que j’ai eu l’occasion de croiser.
En effet, mes six derniers mois ont été rythmés de Moocs, de CTF, d’une summer school, de conférences en cybersécurité et d’entretiens d’embauche.
L’aventure continue par un stage où j’aurai l’opportunité de tester ces connaissances.

J’ai souhaité ici partager le résultat de mes recherches afin d’offrir la possibilité à d’autres personnes de pouvoir s’auto-former.
Cette page se distingue en plusieurs parties :

– Des « Moocs » sur des sujets spécifiques,

– Des « webinar » et « vidéos » pour un format plus visuel,
La partie « ouvrages, articles de référence, sites tutoriels, associations, conférences et blogs utiles » permet d’avoir des ressources vers lesquelles se tourner dans différents sujets pour compléter l’apprentissage des Moocs notamment.
Elle contient également une liste de conférences très précises que j’ai trouvée sur Wikipédia et pour les femmes une liste d’associations de femmes dans la cybersécurité.

– Enfin, la partie CTF et jeux permet la mise en pratique et offre des moments de détentes.

Tous les liens ne sont pas forcéments complètement gratuits, mais je me suis appliquée à rechercher des ressources au moins partiellement gratuites et ouvertes pour que tout le monde puisse s’en emparer.

N’hésitez à compléter en commentaire si vous avez d’autres références ou des events (workshops, bootcamp, summer school, …) à travers le monde.

Aidez moi, s’il vous plait, à compléter ma liste d’associations de femmes dans la cyber si vous en connaissez.

Mooc

Introduction à la Cybersécurité / Introduction to Cybersecurity

Cybersécurité avancée / Advanced Cybersecurity

Cybersécurité et humanités numériques / Cybersecurity and digital humanities

Cryptographie / Cryptography

Données / Data

Blockchain

Réseaux et sécurité des réseaux / Networks and networks’ security

Programmation / Programming

Autres / Others

Webinar

Podcast

Videos

Ouvrages, articles de référence, sites, tutoriels, associations, conférences et blogs utiles / Books, papers, articles, useful websites, tutorials, communities, conferences and blogs

Lois et normes / Law and Policy

Economie / Economy

Cryptographie, mathématiques / Cryptography, maths

Systèmes d’exploitations / Operating System

Blockchain

Géopolitique / Geopolitical

Surveillance, protection des données, fuite de données / Surveillance, Personal Data protection, data leaks

Techniques et outils de cybersécurité, Conférences, Ressources pour apprendre / Cybersecurity techniques and tools, Conventions, learning resources

Initiation à la cybersécurité ou outils pédagogiques d’initiation/ Initiation to cybersecurity or initiation tools

Social Engineering

Internet

Labos et machines virtuelles / Labs and virtual machines

Humanités Numériques / Digital Humanities

Développement d’application, reverse engineering, revue de code / Software development, reverse engineering, code review

Evènements / Events

Jeux, CTF, Wargames, sites à hacker ou app à hacker, guides pour CTF (organisation, participation), Challenges (en crypto ou autre) / Games, CTF, Wargames, vulnerables apps and websites, guides for CTF (organization / participation), Challenges (crypto or else)

Bug bounty platforms

Pourquoi la veille informationnelle est essentielle dans la cybersécurité ?

Article available only in french

Il m’a semblé important d’ajouter un agrégateur de flux RSS dans ce blog du fait de l’importance de la veille informationnelle dans le domaine de la cybersécurité.
Bien sur cela ne vaut pas un travail fait par un veilleur informationnel ou une bonne revue de presse. Cependant, on obtient tout de même en un coup d’oeil les dernières informations de ses médias de prédilection.
Toutefois, j’en profite ici pour vous présenter non seulement en quoi consiste le métier de veilleur-se stratégique mais également comment mettre en place un agrégateur de flux RSS.

Qu’est-ce que la veille informationnelle?

La veille informationnelle est une « activité continue en grande partie itérative visant à une surveillance active de l’environnement technologique, commercial, etc., pour en anticiper les évolutions »

source: Wikipedia

Il s’agit donc de surveiller l’actualité . En cybersécurité, c’est d’autant plus important car se tenir au courant permet d’apporter à ses clients, par exemple, des réponses adaptées aux problèmes de sécurité actuels. Ou simplement de se tenir aux courants des dernières menaces pour mieux s’en protéger.

Il existe d’ailleurs dans les entreprises et les organisations des postes spécialisés pour la veille informationnelle.
Voici la fiche métier de l’Onisep pour vous faire une idée plus précise de ce qu’est un-e veilleu-r-se stratégique.
Pour savoir comment cela se transpose dans la cybersécurité je vous invite à consulter la fiche de poste de l’ANSSI qui donne une idée très précise des tâches incombant au « veilleu-r-se de permanence opérationnelle ».
Dans cette fiche, vous remarquerez la tâche suivante: « suivre l’actualité relative à la sécurité des systèmes d’information en France et dans le monde (attaques informatiques, logiciels malveillants, failles de sécurité, produits de sécurité, etc.) et les médias en sources ouvertes afin de détecter au plus vite toute menace cyber pouvant impacter les intérêts nationaux. »

En cybersécurité, s’informer de l’actualité permet donc d’aider à la détection des menaces.

Finalement le rôle d’un-e veilleur-se opérationnelle est de résumer plusieurs articles qu’il estime pertinent sous forme de revue de presse ou de rapport en fonction des codes imposés par son organisation ou entreprise.
Ce rapport sera consigné et mis à disposition de tous les services de l’organisation ou de l’entreprise.

Voici à quoi ressemble une note pour un rapport ou une revue de presse:
Vulnérabilité dans le noyau Linux de SUSE par le CERT

L’analyse doit être précise et courte pour être percutante comme dans cet exemple:

En résumé un poste de veille opérationnelle dans la cybersécurité est très intéressant car il a plusieurs aspects:

  • C’est très varié: documentation, collecte d’informations relatives à la cybersécurité, détection de menaces, …
  • Si l’on souhaite s’orienter vers un métier plus technique ce poste est un bon point de départ
  • On est au coeur stratégique d’une organisation ou d’une entreprise

Pourquoi un agrégateur de flux RSS?

Un agrégateur est un moyen efficace d’obtenir les dernières informations de vos média d’actualités préférés.
Vous pourrez, en effet, choisir les sources, mais aussi les actualiser à la fréquence que vous jugerez la plus pertinente (jours, heures ou même minutes)
C’est également extrêmement simple à mettre en place sur WordPress

Comment le mettre en place sur WordPress?

    • Télécharger un plugin d’agrégateur de flux rss

J’ai choisi WP RSS Aggregator car il était extrêmement bien noté et vantait le côté intuitif et simple de pour l’installation et la mise en place.

    • L’installer et l’activer
    • Ajouter les flux souhaités et les paramétrer

Voici comment j’ai paramétré mes flux:

La case « Unique titles only » permet d’éviter les doublons elle s’avère assez utile car cela peut arriver.

    • Créer une page pour afficher les flux

J’ai du chercher un peu pour comprendre ce qu’il fallait inscrire dans la page pour afficher le flux il vous suffit simplement d’insérer le code suivant:
[ wp-rss-aggregator ] (en enlevant les espaces avant ‘]’ et après ‘[‘.)

    • Ajouter cette page au menu

Enfin il ne vous reste plus qu’à ajouter cette page à votre menu:

Et voilà!

Comment choisir les références?

Personnellement, j’attache beaucoup d’importance aux sources officielles, c’est pourquoi j’y ai mis le CERT français mais aussi le CERT européen et bien sur l’ANSSI.
Ensuite, j’ai tenté de trouver des médias de référence dans le milieu à l’échelle internationale grâce à mon fil d’actualités sur les réseaux sociaux, en cherchant par exemple les médias le plus souvent cités ou bien en faisant une recherche internet.
Enfin, j’ai aussi proposé mes médias préférés.
Je vous conseille donc de choisir vos références en fonction des besoins de votre activité pour être informé des actualités de votre domaine en temps réel.