IT-Defense 2020Presentations

Presentations – IT-DEFENSE 2020

There is always something new – Update obligations and the information security law – Prof. Dr. Thomas Hoeren

One of the big challenges of the digital economy is the security of information technology. New guidelines and laws are introduced time and again. The European Union, for instance, has passed several regulations on the obligation to install updates and on improving data security, whose outlines are anything but clear. Furthermore, the new information security law imposes numerous requirements, which will be discussed in this presentation.
 

Star Trek: How technical visions become reality – Dr. Hubert Zitt

When Captain Kirk of the starship Enterprise flipped open his communicator at the end of the 1960s, probably nobody imagined that this device would inspire the development of mobile phones 30 years later. Some of these visions of the science fiction authors from the late 20th century have long since become reality today.

How good are or were those visions of the authors of Star Trek regarding man-machine interaction? The touchscreen has already made its way into everyday life. What are the real changes of us being able to speak with computers in the future? And will our generation perhaps be the last that has to learn foreign languages, because soon everyone will carry a universal translator in his or her pocket? Will we in future spend our spare time in a holodeck instead of in front of the TV and interactively participate in what is happening?

In this presentation, the visions of Star Trek will be compared with today’s state of science and technology in both serious and funny ways.
 

Securing Windows in 2019 and Forward – Sami Laiho

In year 2018 the number of malware per day did not increase for the first time in years. On the other hand the amount of money lost because of malware and security breaches more than doubled. The biggest threat to people is currently ransomware, cryptominers and loss of credentials. Join this session to hear one of the worlds leading security professionals, Sami Laiho, give his predictions on security in 2019 and forward, and what Windows can do to protect you in the all the time evolving cybersecurity landscape.
 

Consent, Alignment, and Cooperation in the Internet Era – Paul Vixie

Much of the spectrum of human action and human custom translates more or less obviously from the real world ("meat space") into the Internet ("cyber space"). Yet, some pieces of the human puzzle do not have an obvious place in the Internet game board, and this has wrought unconsidered change to human society through its digital nervous system, the Internet. Is this merely the post-Westphalia era, or as many claim, the post-national era? Let's discuss.
 

Vulnerable Out of the Box - Evaluation of Android Carrier Devices - Ryan Johnson & Angelos Stavrou

Android devices contain pre-installed apps to provide inherent functionality. Pre-installed apps present an attractive target to attackers due to their privileged position and extensive capabilities. This threat is not limited to the theoretical domain as various pre-installed apps have contained design flaws that exposed the end-user to significant risk. Therefore, pre-installed apps warrant additional scrutiny in order to detect capability leaks and adversarial threats in the supply chain. To address the substantial volume of Android vendor firmware images that contain the pre-installed apps, we propose proactively scanning them for vulnerabilities prior to live deployment. We will present some real-world use cases demonstrating the threat to the end-user. As part of our presentation, we will also demonstrate how automated analysis of pre-installed Android apps can help identify potential risks and help mitigate them. Over the past couple of years, Kryptowire was able to identify and report more than 150 CVEs in the Android ecosystem indicating the extent of the problem of software analysis and verification for mobile telecommunication companies, chipset vendors, and device manufacturers.

 

Artificial intelligence: Will we remain smarter than robots? - Boris Nikolai Konrad

There is much speculation, but what are robots really capable of? This presentation shows the opportunities and risks artificial intelligences harbor. The computer scientist and brain researcher Dr. Boris Nikolai Konrad knows how advanced and explored artificial intelligence (AI) yet is. And he is asking the provocative question: Will we remain smarter than robots, which are constantly learning something new? Because what has been shown in Hollywood science fiction movies for decades – loyal companions on adventure trips like R2D2 or villains who want to take over the world – is not what reality looks like.

Boris Nicolai Konrad will demonstrate the role artificial intelligence already plays in our daily life and explain which inventions are going to change our life in the future – from the music play list suggesting the right song to smart homes controlling the energy balance themselves and self-driving cars that learn new things on their own and, according to Konrad, will reach the mass market in only a few years’ time. In an entertaining and exciting way, he will provide a both fascinating and realistic insight into the world of AI and robots.

“The image we have of robots nowadays is almost nostalgic and romanticized,” the brain researcher explains. However, the tin box with a wind-up key on the back has long since been a thing of the past. Instead, there are already computer programs that are more intelligent than we humans are, at least in certain areas. “But we humans can also become more intelligent if we learn from machines or use the findings of brain research. Our willingness to do so will determine whether we will still control computers in the future or vice versa,” says Boris Nikolai Konrad. Amazement and shivers lie close together in his presentation, because the scientific expert equally causes both when he casts a glance into the future of artificial intelligence.

But do we have to be afraid of AI? The speaker clearly points out the dangers of the new technology, but he also sees many opportunities in artificial intelligence, for instance, in medicine or for enterprises: In his presentation, Boris Nikolai Konrad shows how by using big data it is possible to make more precise predictions on customer behavior than through expensive surveys and market studies. He provides concrete recommendations for action to enable companies to align their production, logistics and selling strategies based on big data in order to gain a significant competitive advantage. Because Boris Nikolai Konrad is convinced: “The company that uses the best AI and meanwhile remains willing to learn from it will come out on top.”
 

If you want to Lock, Lock – Don’t Talk: Bypassing Locked Screens with Voice Assistants - Amichai Shulman & Yuval Ron

Voice assistants are becoming an integral part of many computing platforms, including general-purpose computers as well as smartphones. Their usage pattern is such that encourages their use even when the device is in “locked screen” mode. We will show how the introduction into voice assistant capabilities over “locked screen” dramatically influences the security of such devices.

Our presentation includes an introduction to the architecture of voice assistance systems. We will then provide a walkthrough of various security vulnerabilities that stem from enabling voice assistants (including Cortana, Siri, Alexa, and Bixby) over the locked screen in computers and phones. We discuss this side by side with the evolution of the locked screen concept. As a summary, we point out the main failures that led to these vulnerabilities and present some concepts that should be introduced into the locked screen architecture in order to avoid such mishaps.
 

Leading Cybersecurity Change - The Human Perspective – Lance Spitzner

Cybersecurity is no longer just about technology it is ultimately about organizational change. Organizational change in not only how people think about security but what they prioritize and how they act, from the Board of Directors on down. Learn how to become a far more effective security leader by leveraging the principles of behavioral economics and embed security at an organizational level. Key things you will learn include

  • How we are driving attackers to target humans
  • Why so many security initiatives fail at the human level
  • What is a strong security culture and the two key elements to creating one
  • Most common mistakes organizations make attempting to address the human issue

 

PDFex: How to Break PDF Encryption – Jens Müller

PDF is among the most widely used document formats worldwide. To ensure confidentiality, PDF supports document encryption. In this talk, we analyze PDF encryption and show two novel techniques for breaking the confidentiality of encrypted documents. First, we abuse the PDF feature of partially encrypted documents to wrap the encrypted part of the document within attacker-controlled content and therefore, exfiltrate the plaintext once the document is opened by a legitimate user. Second, we abuse a flaw in the PDF encryption specification to arbitrarily manipulate encrypted content. The only requirement is one single block of known plaintext, which we show is fulfilled by design. Our attacks allow the recovery of the entire plaintext of encrypted documents by using exfiltration channels, based on standard compliant PDF properties.

We evaluated our attacks on 27 widely used PDF viewers and found all of them to be vulnerable. We responsibly disclosed the vulnerabilities and supported the vendors mitigating the issues.