theDocumentId => 1333310 Black Hat Europe: Stock Up On New Security Tools ...

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
SecTor
November 4 - October 30, 2021
Toronto, ON, Canada
Black Hat Europe
November 8-11, 2021
Virtual Event
11/20/2018
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat Europe: Stock Up On New Security Tools and Training

If you work in cybersecurity it's important to stay abreast of the latest tools and techniques, and there's no better place to do that than Black Hat Europe in London next month.

As the year winds down around us, now is a good time to be planning ahead for a fruitful new year. If you work in cybersecurity that means keeping abreast of the latest tools and techniques, and there’s no better place to do that than Black Hat Europe in London next month.

For example, MongoDB’s Keeping Secrets: Emerging Practice in Database Encryption Briefing promises an hour dedicated to reviewing the latest advances and breaks in database encryption techniques, including searchable encryption, multi-party authorization, and attribute based access. Expect a deep dive into database encryption threat models and the realities of production ops, including emerging methods around data in-use and blind administrator models.

If you want something of an inside look at how Black Hat’s network works, check out the Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC Briefing from RSA and Red Sky Solutions. It’s your chance to get up close and personal with the Black Hat NOC, as you’ll learn how (and why) equipment and services are deployed on the Black Hat network. You’ll also get insight into the changes made when deploying and securing a network in the U.S., Europe, and Asia, alongside lots of interesting stories and stats! It’s a full debrief of the activity seen this year, what has changed since past shows, and what that means for the industry as whole.

When it comes to threat modeling there can be a gap between academic knowledge and the real world, so it’s important to study real-world examples if you want to keep sharp.  In Toreon’s two-day Advanced Whiteboard Hacking Aka Hands-On Threat Modeling you’ll get some practical threat modeling scenarios based on real projects,  robust training experience, and the templates to incorporate threat modeling best practices in their daily work.

Make time for Not So Secure’s Web Hacking - Black Belt Edition Training if you want to spend two days learning the latest web hacking techniques. You’ll practice some neat, new and ridiculous hacks which affected real products, some of which were bagged in bug bounty programs. The vulnerabilities selected for the class typically either go undetected by modern scanners or rely on overlooked exploits, so it’s a great place to learn something new!

You’ll find a slew of new tools to check out at the Black Hat Europe Arsenal, including Astra: Automated Security Testing For REST APIs.  Built to help developers and security engineers detect and patch vulnerabilities in the initial phase of the development cycle, Astra can automatically detect and test login & logout (Authentication API), which makes it easy for anyone to integrate this into CICD pipeline. Astra can also take API collection as an input, making it a great tool for testing APIs in standalone mode.

You might also enjoy an Arsenal demo of SCAVENGER: A Post-Exploitation Scanning/Mapping Tool, which can help you by mapping systems and finding "interesting" and most frequently used files, folders and services. Once credentials are gained, it can scan remote systems (Linux, Windows and OSX) via services like SMB and SSH to scrape that system looking for "interesting" things and then cache the result. This gives you the ability to find the "interesting" and most frequently files used on that system -- password files being accessed by an administrator, for example, or heavily-used credit card database files. Don’t miss it!

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
lahome
50%
50%
lahome,
User Rank: Apprentice
11/21/2018 | 8:47:06 PM
GOOD ARTICLE
New security tools and traiding are very necessary.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23416
PUBLISHED: 2021-07-28
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
CVE-2021-23417
PUBLISHED: 2021-07-28
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
CVE-2021-23415
PUBLISHED: 2021-07-28
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVE-2020-4974
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
CVE-2020-5004
PUBLISHED: 2021-07-28
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.