User:M3m0r3x - Revision history

M3m0r3x at 10:57, 5 September 2017

2017-09-05T10:57:30Z

M3m0r3x: /* Day Three */

2017-08-28T07:11:53Z

‎Day Three

M3m0r3x: /* Day Two */

2017-08-28T06:53:49Z

‎Day Two

M3m0r3x: /* Things done on Camp */

2017-08-28T06:21:17Z

‎Things done on Camp

M3m0r3x: /* Day Five */

2017-08-27T15:54:59Z

‎Day Five

M3m0r3x: /* Day Five */

2017-08-27T15:31:48Z

‎Day Five

M3m0r3x: /* Day Two */

2017-08-27T13:29:45Z

‎Day Two

M3m0r3x: /* Day Two */

2017-08-27T13:28:30Z

‎Day Two

M3m0r3x: /* Day Two */

2017-08-27T13:03:30Z

‎Day Two

M3m0r3x: /* Day Two */

2017-08-27T12:26:53Z

‎Day Two

@@ Line 9: / Line 9: @@
 }}
 == Camp Notes ==
 == Things done on Camp ==

@@ Line 142: / Line 142: @@
 === Day Three ===
 '''Data Exploitation <br />
-This talk is manly about data privacy. It make aware of what different kind of products collect what kind of data. Among these are even very sensitive data. The Talk even shows that it is somtin´mes easy to get on this (sensitive) date, even you should not. The speakers are from Privacy International. For introduction the speakers make aware of different privacy failes were data of persons were leaked. They described the Roomba case were Roomba is selling the maps their robots make while cleaning. Or different GSM Codes on Smartphones wich users not aware of. The main part of their Talk is about who they do reversing different types of connected thing (IoT) One example is who they reversed cars (Jaguar/Landrover/BMW) by the CANbus, a protocol for connected cars. Their Aim is to have a look on the collected data by the cars.
+This talk is manly about data privacy. It makes aware of what different kind of products collect what kind of data. Among these are even very sensitive data. The Talk even shows that it is somtimes easy to get on this (sensitive) date, even you should not. The speakers are from Privacy International. For introduction the speakers make aware of different privacy fails were data of persons were leaked. They described the Roomba case were Roomba is selling the maps their robots make while cleaning the rooms. Or different GSM Codes on Smartphones which users not aware of. The main part of their Talk is about how they do reversing different types of connected thing (IoT). One example is how they reversed cars (Jaguar/Landrover/BMW) by the CANbus, a protocol for connected cars. Their aim is to have a look on the collected data by the cars.
-Another Topic was healthcare products (Drug pumps, defibrillators, pacemakers....). Even data from those devices while given to third parties. A special guest speaker from cameo with an implanted pacemaker told about her Projekt "Pacemaker Hacking". She was able to hook up to the device and was able to read out all collected data. She called it a project of her own critical infrastructure. She startet her project after she was in hospital because of a malfunction of her pacemaker. She was interested in the data output. She even asks if she can get that file. The doctor even copied it on her flash drive. After analyzing she noticed, it is a memory dump (of her heart). This guest speaker part of the talk was very scary to me.<br />
+Another Topic was healthcare products (Drug pumps, defibrillators, pacemakers....). Even data from those devices are given to third parties. A special guest speaker from Cameo, with an implanted pacemaker told about her project "Pacemaker Hacking". She was able to hook up to the device and to read out all collected data. She called it a project of her own critical infrastructure. She started her project after she was in hospital because of a malfunction of her pacemaker. She was interested in the data output. She even asks if she can get that file. The doctor even copied it on her flash drive. After analyzing she noticed, it is a memory dump (of her heart). This guest speaker part of the talk was very scary to me.<br />
 ''Recording: ''[https://media.ccc.de/v/SHA2017-267-data_exploitation data_exploitation] <br />
 '''A look at TR-06 FAIL and other CPE Configuration Management Disasters''' <br />
 This Talk is, as the name suggests , about the TR-06X protocols and related vulnerabilities (TR-06FAIL, Misfortune Coockie...) and hacking ACS Servers.
 TR-XXX are DSL Forum specifications. For interest in this talk are TR-064 and TR-069. <br />
-TR-064 is LAN-Side DSL CPE Configuration. It is a SOAP based protocol to allow configuration of CPE devices from the LAN side, for example, by "Broadband Setup" software shipped to consumers. It allows managing any setting on a CPE device. It has total read and write to full device configuration, for example ACS configurations, DNS settings wireless security and so on. Some of it's security specifications are: Access to any action that allows configuration changes to the CPE must be password protected. Access to any password protected action must require HTTP digest authentication. Sensitive information, such as passwords must not be readable at all. Its also ment to listen on te LAN interface... The reality shows TR-06Fail... Password protected --> No, Actual credentials (WiFi Keys) readable --> yes, accessible from the internet --> yes and trivial vcommand injection vulnerabilities on top. This was used in the Deutsche Telekom and TalTalk Before the hack. Before the TR-06FAIL there was the Misfortune Cookie Vulnerability. It affected the same RomPager server. It allowed remotely accessing the device without authentication.<br />
+TR-064 is LAN-Side DSL CPE Configuration. It is a SOAP based protocol to allow configuration of CPE devices from the LAN side, for example, by "Broadband Setup" software shipped to consumers. It allows managing any setting on a CPE device. It has total read and write to full device configuration, for example ACS configurations, DNS settings wireless security and so on. Some of it's security specifications are: Access to any action that allows configuration changes to the CPE must be password protected. Access to any password protected action must require HTTP digest authentication. Sensitive information, such as passwords must not be readable at all. It's also meant to listen on the LAN interface... The reality shows
-TR-069 is the CPE WAN Management Protocol (CWMP). It outlines the protocol for management of CPE devices over WAN. Also SOAP based. It is a kind of backdoor in the false hands. Before the TR-06FAIL there was the Misfortune Cookie Vulnerability. It affected the same RomPAger server. It allowed remotely accessing the device without authentication. It allows overwriting internal state variables on the TR-069 service on the router. It was able to bypass the CWMP port check and the password check. The TR-069 says it has TLS and authentication but it is bot optional. The authentication from CPE to ACS uses often basic-auth. It often uses the username as identifier. From ACS to CPE is often TLS (client cert) u can be a shared secret without TLS. One big mess is the use of different XML stuff wich makes a immense attack surface...
+TR-06Fail...:
 Hacking an ACS server is a way quicker than hacking millions of CPE's one at a time. The speaker audited five different ACS products (FreeACS, OpenACS, LibreACS, a PHP CWMP library and Perl cwmp). In every product he found vulnerabilities to compromise it remotely to take over possible managed CPE's.
 This recording is really worth a look. His next projects are: Auditing more ACS stuff (GenieACS, FreeACS-NG, Draytek, Cisco...), Auditing more CPE device implementation and Looking into TR-111 (TR069 for IoT like set top boxes....)
 <br />
-''Recording: "[https://media.ccc.de/v/SHA2017-176-a_look_at_tr-06fail_and_other_cpe_configuration_management_disasters a_look_at_tr-06fail_and_other_cpe_configuration_management_disasters]<br />
+''Recording: ''[https://media.ccc.de/v/SHA2017-176-a_look_at_tr-06fail_and_other_cpe_configuration_management_disasters a_look_at_tr-06fail_and_other_cpe_configuration_management_disasters]<br />
 '''Cheese Tasting''' <br />
 In the evening there was another tasting like yesterday. This time cheese. Different sorts were presented from mild to strong. Highlight was a truffle cheese from the Normandy. It was really delicious. But there were other sorts from Germany, the Netherlands (old Amsterdam, old Rotterdam...) and the Normandy (Camembert and Brie). This tasting was really good to get an overview of different cheese sorts. <br />
 '''Fun Fact of the Day''' <br />
 Late at night some people noted a notice on their badge that said: Your Badge is locked! Please go to ### to unlock it.
-Unfortunately on the given location nobody was there to unlock it. A member of our village was infected, too by this malware and he only flashed his badge to the current firmware and all was fixed again...
+Unfortunately on the given location nobody was there to unlock it. A member of our village was infected, too by this malware and he only flashed his badge to the current firmware and all was fixed again... >Later someone developed a second ransomware.The Ransom in this case was to bring a "Club-Mate" to unlock it.
 === Day Four ===

@@ Line 109: / Line 109: @@
 === Day Two ===
 '''TOR de-anonymization techniques''' <br />
-This talk was about TOR anonymity. The speaker is the founder of the TOR hiddden service search engine Ahemia. In his talk he gave a little overview on how TOR and Hidden Services work. Further in his talk he mentioned on examples from official leaked presentations like from the Snowden Leak that de-anonymizing a specific user is really hard and kind of a pain in the a... . It is easy to de-anonymize random users but not specific ones. The speaker described on current takedowns the different techniques that are used for it. First, OpSec failures. As example he took the Alphabay and SilkRoad takedown. Both leading administrators made OpSec failiures. In he case of Alphabay the welcome mail after registration came from his private E-Mail Account on hotmail. This was the weak link which identified the admin. In the case of SilkRoad the Admin asked questions regarding hidden service configurations in the Stack Overflow Forum under his real name, Ross Ulbricht and brought up the name off silkroad. The Second topic of de-anonymizing hidden Services or user is by attacking the end device it self. This technique was used by the FBI when they ran a child abuse platform after they seized the servers. They were able to do this by the third topic. They attacked the hidden service wich was misconfigured and by this  it has some vulnerabilities wich were used to leak the real IP. The last point on how a specific user can be deanonymized is by traffic and timing correlation. But this is really complex and both, the used TOR entry node and the exit node must be owned by the observer. So it seems, tor is a really good anonymizing network.<br />
+This talk was about TOR anonymity. The speaker is the founder of the TOR hidden service search engine Ahemia. In his talk he gave a little overview on how TOR and especially hidden services work. Further in his talk he mentioned on examples from official leaked presentations like from the Snowden Leak that de-anonymizing a specific user is really hard and kind of a pain in the a... . It is easy to de-anonymize random users but not specific ones. The speaker described on current take downs the different techniques that are used for it. First, OpSec failures. As example he took the Alphabay and SilkRoad take down. Both leading administrators made OpSec failures. In he case of Alphabay the welcome mail after registration came from his private E-Mail Account on hotmail. This was the weak link which identified the admin. In the case of SilkRoad the admin asked questions regarding hidden service configurations in the Stack Overflow Forum under his real name, Ross Ulbricht and brought up the name off SilkRoad. The Second topic of de-anonymizing hidden Services or user is by attacking the end device it self. This technique was used by the FBI when they ran a child abuse platform after they seized the servers. They were able to do this by the third topic. They attacked the hidden service which was mis-configured and by this  it has some vulnerabilities which were used to leak the real IP. The last point on how a specific user can be de-anonymized is by traffic and timing correlation. But this is really complex and both, the used TOR entry node and the exit node must be owned by the observer. So it seems, tor is a really good anonymizing network.<br />
 ''Recording :'' [https://media.ccc.de/v/SHA2017-102-tor_de-anonymization_techniques tor_de-anonymization_techniques] <br />
 '''An academic view on incident response''' <br />
-This talk is mainly forensics. In his talk the speaker talks about challenges, do's and don'ts. nearly to the end he talks about what can one do to be prpared. IR is to detect introusions in time. Companies that failed are for example Asly Madison, Hackingg Team, RSA.... The pres wants to adapt a new buzzword for them.APT. A spearfishing Campaign is not an APT. At the beginnig the nature of an incident is that you don't know what is happening. The goals are to react to the security related event  and to containment the an affected system or find other ways to prevet this. This could be in ideally a live forensic under time preassure and the incedent manager should move faster like the attacker, even remotly. Everything went wired if press is involved, Then the stress level will rise. Standards in the field of IR are:
+This talk is mainly forensics. In his talk the speaker talks about challenges, do's and don'ts in incident response. Nearly to the end he talks about what can be done to be prepared. Incident response is to detect intrusions in time. Companies that failed are for example Ashly Madison, Hacking Team, RSA.... The press wants to adapt a new buzzword for hacks like these. APT. For this APT is of course the wrong word.  A spearfishing campaign is not an APT. At the beginning the nature of an incident is that you don't know what is happening. The goals are to react to the security related event and to containment the an affected system or find other ways to prevent this. This could be ideally a live forensic under time pressure and the incident manager should move faster like the attacker, even remotely. Everything went wired if press is involved, then the stress level will rise. Standards in the field of IR are:
-* RFC 3227: Guidlines for Evedince Collection and Archiving
+* RFC 3227: Guidelines for Evidence Collection and Archiving
 * NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
 What are the current challenges? (Simson Garfinkel)
@@ Line 124: / Line 125: @@
 * broader diversity
-Still a problem is storage capacity (hash the data, copy it and hash again). Special devices do this, they are very expensive. Imaging a 12 TB Harddrive takes ages. Encryptions make investigationes even mre tricky. But still encryption can be bypassed, fingerprinted or meta data can be analyzed. Another Chanllenge is the heterogenity of Systems. Cloudforensics is anothrer big challenge.
+Still a problem is storage capacity (hash the data, copy it and hash again). Special devices do this, they are very expensive. Imaging a 12 TB hard drive takes ages. encryption make investigations even more tricky. But encryption can still be bypassed, fingerprinted or meta data can be analyzed. Another Challenge is the heterogeneity of Systems. Cloud forensics is another big challenge.
-Do's and dont's
+Do's and don'ts:
 Rule: Take a RAM image.
 it has much valuable information like encryption keys.
-Rebooting the machine or pull the plug? Don't shut down, pull the plug! Everything will cleard on a clean shutdown. Whenn you pull the plug you can try a cold boot attack.
+To be prepared:
-To be prepared: Log all the things. Log helps trwmwndously on both network and operating system.
+At the end of his talk the speaker mentioned a tool called grr. It is developed and used by Google for incident response and it is free for use and open source. It can be found [https://github.com/google/grr here] an should worth a look. <br />
 ''Recording: '' [https://media.ccc.de/v/SHA2017-316-an_academic_s_view_to_incident_response an_academic_s_view_to_incident_response]<br />
 '''Cidre Tasting''' <br />
 At the food hacking base there was a ciders tasting. Our complete village took part there. Different ciders were presented from low cost supermarket ciders to really high cost ciders from the Normandy. For me cider is not my taste. It doesn't matter which one I tasted. The best drink during the tasting was an apple juice from the Normandy :-).

@@ Line 69: / Line 69: @@
 [[File:SHA2017.jpg|thumb|center]]
-We arrived at Zeewolde at approximate 01:00 pm. Of course first we build up our village "1838". The rest of the day we were carrying our luggage and equipment from the parking lot to the camp at the Turing field. Then of course we built up the infrastructure to our tents (power and LAN from the Datenklo). I was setting up an accespoint for our village wich is based on an raspberry-pi wich connects all the traffic by tor and separates us from the Camp LAN. It is not that we don't trust the SHA2017 people but...
+We arrived at Zeewolde at approximate 01:00 pm. Of course first we build up our village "1838". The rest of the day we were carrying our luggage and equipment from the parking lot to the campground at the Turing field. Then of course we built up the infrastructure to our tents (power and LAN from the Datenklo). I was setting up an access-point for our village which is based on an raspberry-pi which connects all the traffic by tor and separates us from the Camp LAN. It is not that we don't trust the SHA2017 people but...
 [[File:Parts of luggage.jpg|thumb|center]]
@@ Line 75: / Line 75: @@
 [[File:Powerup.jpg|thumb|center]]
-After work was done we drank some beer and walked over the camp ground to check out different locations. We of course visited the SHA-Habour wich was build up just for this event for people who come by (House)boat. After that we tried to find the food curt. As we found it, it was unfortunately closed. Some people of our village registered their DECT phone at event phone. There was not much built up at day zero. Just some big projects built up there stuff but most of the people where normal campers. We visit also the so called "Food Hacking Base" were a bunch of people do all things with food. There are also workshops like a cheese and a whisky tasting, molekular kitchen and so on. And we all donated a bit of money to get three meals a day (breakfast, lunch and dinner) on every day.
+After work was done we drank some beer and walked over the camp ground to check out different locations. We of course visited the SHA-Habour wich was build up just for this event for people who come by (house)boat. After that we tried to find the food curt. As we found it, it was unfortunately closed. Some people of our village registered their DECT phone at the info tent. There was not much built up at day zero. Just some big projects built up there stuff but most of the people where normal campers. We visit also the so called "Food Hacking Base" were a bunch of people do all things with food. There are also workshops like a cheese and a whisky tasting, molecular kitchen and so on. And we all donated a bit of money to get three meals a day (breakfast, lunch and dinner) on every day.
 '''Fun Fact of the day'''
@@ Line 84: / Line 84: @@
 === Day One ===
 '''Opening Talk''' <br />
-This was just the opening talk for the awesome SHA2017 Camp. Stitch, the main organizator of this event told in this Talk who it was rganizing the camp and what has gone wrnge at the very first beginning for example with the batch production. But in the end all has gone good and he celebrated with us the opening of this camp. <br />
+This was just the opening talk for the awesome SHA2017 Camp. Stitch, the main organizator of this event told in this Talk how it was to organizing the camp and what has gone wrong at the very first beginning for example with the batch production. But in the end all has gone good and he celebrated with us the opening of this camp. <br />
 ''Recording:'' [https://media.ccc.de/v/SHA2017-251-sha2017_opening sha2017_opening]
 '''Crypto Wars 2.0: Lessons learned from the past, for the present'''<br />
-Phil Zimmerman, founder of PGP,  held a very political keynote at the beginning. In his talk he speaks about the willing from different politics to backdoor or harm cryptography for instigation purposes. This was in the history done on many other technologies. For example in the time of Bonnie and Clyde, the police was not able to catch them up because after every robbery the drove away fast. As consequences the politics wanted to shorten the tanks of the car so that the police is able to catch them up while they were going out of gas. The main statement of his talk is: backdoors for the good guy are backdoors for the bad guys.<br />
+Phil Zimmerman, founder of PGP,  held a very political keynote at the beginning. In his talk he speaks about the willing from different politics to backdoor or harm cryptography for instigation purposes. This was in the history done on many other technologies. For example in the time of Bonnie and Clyde, the police was not able to catch them up because after every robbery they drove away fast. As consequences the politics wanted to shorten the tanks of the car so that the police is able to catch them up while they were going out of gas. The main statement of his talk is: backdoors for the good guy are backdoors for the bad guys.<br />
-It was really an honor to se the man live on stage who brought the people PGP, strong Crypto for the masses. <br />
+It was really an honor to see the man live on stage who brought the people PGP, strong Crypto for the masses. <br />
 ''Recording:'' [https://media.ccc.de/v/SHA2017-336-cryptowars_2_0_lessons_from_the_past_for_the_present cryptowars_2_0_lessons_from_the_past_for_the_present] <br />
 '''Attacking OpenSSL using Sidechannel Attacks''' <br />
-Not seen live but later in the recording because of the parallel keynote from Phil Zimmermann. But it was very interesting how to get on Information on Side channels. An embedded device or a computer has some interfaces like Keyboard, Monitor, Speaker etc. that are intended. But there are also some unintended interfaces. They are there and you can't do anything to hide or manipulate them. For example: Time, power consumption electro magnetic radiation etc. On a short example they demonstrated a 4 digit brute force attack on how they exploit the side channel of power / EM. On a given 4 digit pin they monitored the normal power behavior. Then they started with figure one to brute force the pin. on one number (8) they saw that the pattern of the verification was shifted a little bit to the right. This means more power was used due to a abnormal behavior. Same with the second digit. when the correct number was entered the pattern for verification moved again a bit to the right, and so on. For a four digit pin this can be done in short amount of time. But on a 2048bit RSA secret key this would take years. In the further talk the presenters explained how to solve this by math and improve the efficiency. Unfortunately this is not my grade of math :-). After that they showed some lab setups how they analyze those side channels for example by the use of an oscilloscope. <br />
+Not seen live but later in the recording because of the parallel keynote from Phil Zimmermann. But it was very interesting how to get on Information on Side channels. An embedded device or a computer has some interfaces like Keyboard, Monitor, Speaker etc. that are intended. But there are also some unintended interfaces. They are there and you can't do anything to hide or manipulate them. For example: Time, power consumption, electromagnetic radiation etc. On a short example they demonstrated a 4 digit brute force attack on how they exploit the side channel of power / EM. On a given 4 digit pin they monitored the normal power behavior. Then they started with figure one to brute force the pin. on one number (8) they saw that the pattern of the verification was shifted a little bit to the right. This means more power was used due to a abnormal behavior. Same with the second digit. When the correct number was entered the pattern for verification moved again a bit to the right, and so on. For a four digit pin this can be done in short amount of time. But on a 2048bit RSA secret key this would take years. In the further talk the presenters explained how to solve this by math and improve the efficiency. Unfortunately this is not my grade of math :-). After that they showed some lab setups how they analyze those side channels for example by the use of an oscilloscope. <br />
 ''Recording:'' [https://media.ccc.de/v/SHA2017-169-attacking_openssl_using_side-channel_attacks attacking_openssl_using_side-channel_attacks]<br />
 '''Famous C&C servers from inside to outside''' <br />
-The speaker gave a in depth look in botnet architectures. He describes who he brokes in the cryptolocker botnet and shows how a Man in the browser Attack works. He speaks about the NAS Botnet which infected QNAP devices, hack them, infected them, armed them and patched them. He gives an overview of the Kins Botnet which has a better E-Banking web application as his bank. :-). He discloses in the End the PoC of the "Vodafone NL Dray Tek Vigor2132FVn Hack" which was already fixed by VF-NL. <br />
+The speaker gave a in depth look in botnet architectures. He describes how he brakes in the cryptolocker botnet and shows how a Man in the browser Attack works. He speaks about the NAS Botnet which infected QNAP devices, hack them, infected them, armed them and patched them. He gives an overview of the Kins Botnet which has a better E-Banking web application as his bank. :-). He discloses at the end the PoC of the "Vodafone NL Dray Tek Vigor2132FVn Hack" which was already fixed by VF-NL. <br />
-''Recording:'' [https://media.ccc.de/v/SHA2017-315-famous_c_c_servers_from_inside_to_outside#video&t=428 famous_c_c_servers_from_inside_to_outside]<br />
+''Recording: '' [https://media.ccc.de/v/SHA2017-315-famous_c_c_servers_from_inside_to_outside#video&t=428 famous_c_c_servers_from_inside_to_outside]<br />
 ''PDF-File: '' [https://program.sha2017.org/system/event_attachments/attachments/000/000/063/original/Research_Articles_.pdf Research_Articles_.pdf]<br />
 '''Batch soldering''' <br />
-In a soldering session in our village we soldered the SMA LEDs and the vibrating motor to our Batch. For me SMA soldering was a new experience. We got different tips how to do this best. For me the best methods is to give a bit solder on the soldering pads, attach the SMA LED with a tweezers and heat the solder on the pads again. Another tip was to only to give solder to one pad heat it again an push the SMA LED with your finger to the pad. So the SMA LED is fixed and play to the circuit board. Then just add solder to the other three pads.
+In a soldering session in our village we soldered the SMA LEDs and the vibrating motor to our batch. For me SMA soldering was a new experience. We got different tips how to do this best. For me the best methods is to give a bit solder on the soldering pads, attach the SMA LED with tweezers and heat the solder on the pads again. Another tip was to only give solder to one pad heat it again an push the SMA LED with your finger to the pad. So the SMA LED is fixed and flat to the circuit board. Then just add solder to the other three pads.
 '''Fun Fact of the day'''

@@ Line 181: / Line 181: @@
 ''Recording: '' [https://media.ccc.de/v/SHA2017-269-exploiting_twitter_with_tinfoleak_for_investigative_purposes exploiting_twitter_with_tinfoleak_for_investigative_purposes]<br />
 '''DDoS attack and defense''' <br />
-The speaker of this talk works at a hostingprovider and in his talk he talks about basic of DDoS and goes deeper into some DDoS Attacks. In his presentation he will talk about Detection and defense, also. And he points out some Aggressive network defense techniques. DoS Vunerabilities can caused by different thing, Missconfiguratins, License Problems etc. He described some  Attacks on layer 3 and 4. (IP, TCP, UDP and Layer 7 Attacks like slow lories. He shows some tools like Web LOIC. Because of the technicaly detailed talk it is really worth to watch in the recording below.  <br />
+The speaker of this talk works at a hostingprovider and in his talk he talks about basic of DDoS and goes deeper into some DDoS Attacks. In his presentation he will talk about Detection and defense, also. And he points out some Aggressive network defense techniques. DoS Vunerabilities can caused by different thing, Missconfiguratins, License Problems etc. He described some  Attacks on layer 3 and 4. (IP, TCP, UDP and Layer 7 Attacks like slow lories. He shows some tools like Web LOIC. Later he explaines how some DDoS-Aplliences work and he further gave some examples how different Vendors (Aplliences)  do their job.  He explaines many Countermesures. He allso talks about Counter-Countermessures.Some of them are verry new to me. Because of the technicaly detailed talk it is really worth to watch in the recording below. This talk was verry interesting <br />
 '''FaceDancer 2.0'''<br />
 This talk is about a USB attack device called Face Dancer 2.0.  It is capabel to fuzz / monitor or mitm USB Devices, even embedded ones like in cars. The speakers gave a deep dive on how USB works. It was a really complex, technically talk. The Face Dancer 2 is capable to emulate four different device types. It will be available as shield for RPi or Beaglebone board and other implementations. So what can the Face Dancer do? It can attack USB hosts and driver stacks, fuzzing for example with umap. It can fingerprint USB implementations to identify host OS e.g. And it can emulate USB devices for (HID, USB Mass Storage, FTDI, DFU (steal device firmware))  <br />