Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
May 10-13, 2022
Hybrid/Marina Bay Sands, Singapore
Black Hat USA
August 6-11, 2022
Las Vegas, NV, USA
Black Hat Europe
December 5-8, 2022
London
End of Bibblio RCM includes -->
11/20/2018
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates

Black Hat Europe: Stock Up On New Security Tools and Training

If you work in cybersecurity it's important to stay abreast of the latest tools and techniques, and there's no better place to do that than Black Hat Europe in London next month.

As the year winds down around us, now is a good time to be planning ahead for a fruitful new year. If you work in cybersecurity that means keeping abreast of the latest tools and techniques, and there’s no better place to do that than Black Hat Europe in London next month.

For example, MongoDB’s Keeping Secrets: Emerging Practice in Database Encryption Briefing promises an hour dedicated to reviewing the latest advances and breaks in database encryption techniques, including searchable encryption, multi-party authorization, and attribute based access. Expect a deep dive into database encryption threat models and the realities of production ops, including emerging methods around data in-use and blind administrator models.

If you want something of an inside look at how Black Hat’s network works, check out the Decisions and Revisions - The Ever Evolving Face of the Black Hat NOC Briefing from RSA and Red Sky Solutions. It’s your chance to get up close and personal with the Black Hat NOC, as you’ll learn how (and why) equipment and services are deployed on the Black Hat network. You’ll also get insight into the changes made when deploying and securing a network in the U.S., Europe, and Asia, alongside lots of interesting stories and stats! It’s a full debrief of the activity seen this year, what has changed since past shows, and what that means for the industry as whole.

When it comes to threat modeling there can be a gap between academic knowledge and the real world, so it’s important to study real-world examples if you want to keep sharp.  In Toreon’s two-day Advanced Whiteboard Hacking Aka Hands-On Threat Modeling you’ll get some practical threat modeling scenarios based on real projects,  robust training experience, and the templates to incorporate threat modeling best practices in their daily work.

Make time for Not So Secure’s Web Hacking - Black Belt Edition Training if you want to spend two days learning the latest web hacking techniques. You’ll practice some neat, new and ridiculous hacks which affected real products, some of which were bagged in bug bounty programs. The vulnerabilities selected for the class typically either go undetected by modern scanners or rely on overlooked exploits, so it’s a great place to learn something new!

You’ll find a slew of new tools to check out at the Black Hat Europe Arsenal, including Astra: Automated Security Testing For REST APIs.  Built to help developers and security engineers detect and patch vulnerabilities in the initial phase of the development cycle, Astra can automatically detect and test login & logout (Authentication API), which makes it easy for anyone to integrate this into CICD pipeline. Astra can also take API collection as an input, making it a great tool for testing APIs in standalone mode.

You might also enjoy an Arsenal demo of SCAVENGER: A Post-Exploitation Scanning/Mapping Tool, which can help you by mapping systems and finding "interesting" and most frequently used files, folders and services. Once credentials are gained, it can scan remote systems (Linux, Windows and OSX) via services like SMB and SSH to scrape that system looking for "interesting" things and then cache the result. This gives you the ability to find the "interesting" and most frequently files used on that system -- password files being accessed by an administrator, for example, or heavily-used credit card database files. Don’t miss it!

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
//Comments
Newest First  |  Oldest First  |  Threaded View
lahome
lahome,
User Rank: Apprentice
11/21/2018 | 8:47:06 PM
GOOD ARTICLE
New security tools and traiding are very necessary.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Developing and Testing an Effective Breach Response Plan
Whether or not a data breach is a disaster for the organization depends on the security team's response and that is based on how the team developed a breach response plan beforehand and if it was thoroughly tested. Inside this report, experts share how to: -understand the technical environment, -determine what types of incidents would trigger the plan, -know which stakeholders need to be notified and how to do so, -develop steps to contain the breach, collect evidence, and initiate recovery.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-4264
PUBLISHED: 2022-12-09
Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.
CVE-2022-44213
PUBLISHED: 2022-12-09
ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-2752
PUBLISHED: 2022-12-09
A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issue affects: Secomea GateManager versions from 9.4 through 9.7.
CVE-2022-4377
PUBLISHED: 2022-12-09
A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched rem...
CVE-2022-4375
PUBLISHED: 2022-12-09
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t...