Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
November 4 - October 30, 2021
Toronto, ON, Canada
Black Hat Europe
November 8-11, 2021
Virtual Event
09:00 AM
Black Hat Staff
Black Hat Staff
Event Updates

Learn How to Better Protect your Network at Black Hat Europe

Whether you're sussing out vulnerabilities or defending enterprise networks, Black Hat Europe's lineup of Briefings, Trainings, and Arsenal tools will help you take things to the next level.

Network defense is a fundamental aspect of cybersecurity, so if you’re attending Black Hat Europe in London next month consider making time to check out some of the latest techniques and tools at this premier information security event.

In Stage 2 Security’s AWS & Azure Exploitation: Making The Cloud Rain Shells! Training, attendees will get valuable insight into how to apply modern penetration testing skills to cloud-centric networks and environments. This fast-paced, hands-on course is designed to equip you with the tools, tactics, and techniques you need to infiltrate and expand access within remote networks, which are ever more common in today’s cloud-centric world.

Hone your network pentesting skills at Pentesting Academy’s Active Directory Attacks For Red And Blue Teams Training, which will demonstrate how to attack the modern Active Directory environment using built-in tools like PowerShell and other trusted OS resources. This is important because AD often forms the backbone of the complete enterprise network, and to secure such networks against bad actors it’s critical to understand AD and the different techniques and attacks used against it.

Speaking of Active Directory attacks, The University of Tokyo will be presenting a Briefing on Real-Time Detection of Attacks Leveraging Domain Administrator Privilege  You’ll learn how attackers targeting the Active Directory try to take over Domain Administrator privilege and create a backdoor which disguises them as arbitrary legitimate accounts, in order to obtain long-term administrator privilege. This Briefing will also introduce you to a real-time detection method for attack activities leveraging Domain Administrator privilege (including Golden Tickets) by using Domain Controller Event logs.

In Gigamon’s Network Defender Archeology: An NSM Case Study in Lateral Movement with DCOM, Black Hat Europe attendees will learn to combat attackers making malicious use of Windows’ Component Object Model (COM) and Distributed Component Object Model (DCOM) systems. This Briefing will showcase how DCOM can be used as a lateral movement technique by antagonists, and provide a methodical walkthrough of the technique from both the attacker and defender perspectives.

Also, make time to swing by the Black Hat Europe Arsenal and check out some useful new network protection tools, including LMYN: Let’s Map Your Network. Network security depends on you having a complete picture of all the systems which are connected to your network, and LMYN aims to provide (using basic network commands like traceroute, ping scans, etc.) an easy-to-use interface with which security engineers and network administrators can map their domains in graphical form with zero manual error.

If you’re concerned about wireless network breaches, check out the Drosera: Using Wireless Honeypot to Protect Wireless Networks Arsenal demo. Drosera is a wireless honeypot platform for discovering wireless intrusion attacks and identifying intruders. When an attacker takes the bait and goes after a Drosera-protected honeypot network, Drosera will record all actions before and after the attacker connects to the network, including the process of attempting to connect to the network at the 802.11 frame level. Drosera can accurately identify the attack, and, what’s more, it can help you get information about who’s attacking your network(s), how they’re doing it, and how good they really are.

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
11/30/2018 | 12:47:40 AM
Learn how to fight!
It's interesting that in order to protect yourself, you have to learn about the dangers that are coming after you first.  You're going to know what exactly it is that you're trying to prevent from coming into your system so that you can be better equipped to make sure they can't gain entry. It's an interesting concept to use this idea to train people to recognize the threats better and I think that the programme most certainly will benefit a lot of businesses in the end!
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-11-27
janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
PUBLISHED: 2021-11-26
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via C...
PUBLISHED: 2021-11-26
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious...
PUBLISHED: 2021-11-26
Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other se...
PUBLISHED: 2021-11-26
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be add...