Talk Schedule

Opening speech by our President, the Conference VP and our sponsor CyberEco // Discours d'ouverture par le président, le Vice-président aux conférences et notre partenaire CyberEco

Break

⌛️

Location: Ballroom

Location: Workshop 2 room located in Community Room

Location: Podcast recording studio in Salle de la commune

CTF Registration

This is the moment to setup your laptop and other equiment. Make sure you have your Eventbrite ticket printed or on your mobile phone.

CTF Starts

The CTF officially starts. Challenges are accessible to everyone.

CTF

This is the time where you score flags. For announcements, make sure to follow on our Discord server and your team's Discourse.

CTF Ends

The CTF officially ends. Pack your things and mingle while we prepare the closing ceremony.

Red Team

The purpose of the Red Team Training is to understand the underlying concept of red teaming. The training will cover payloads generation, lateral movement techniques, initial foothold and internal reconnaissance. The training is aiming to provide a deep understanding of all the previously described aspects of a red team. Click here for Training Syllabus

Charles F. Hamilton (Mr.Un1k0d3r) Director, KPMG Canada

Charles Hamilton is a Red Teamer, with more than ten years of experience delivering offensive testing services for various government clients and commercial verticals. In recent years, Charles has focused on covert Red Team operations against complex and secured environments. These operations have allowed him to hone his craft at quietly navigating a client's network without detection. Since 2014, he is the founder and operator of the RingZer0 Team website, a platform focused on teaching hacking fundamentals. The RingZer0 community currently has more than 40,000 members worldwide. Charles is also a prolific toolsmith and speaker in the Infosec industry under the handle of Mr.Un1k0d3r.

White Knight Labs - Offensive Development

Dive deep into cutting edge techniques that bypass or neuter modern endpoint defenses. Learn how these solutions work to mitigate their utility and hide deep within code on the endpoint. The days of downloading that binary from the internet and pointing it at a remote machine are over. Today’s defenses oftentimes call for multiple bypasses within a single piece of code. Click here for Training Syllabus

Greg Hatcher , White Knight Labs

Greg has a background in Army Special Forces and teaching Windows internals at the NSA. He also led a 3-man red team for CISA that specialized in attacking America’s critical infrastructure. He authored and teaches WKL’s flagship course, Offensive Development, at Wild West Hackin’ Fest and virtually on the Antisyphon platform. Greg is passionate about C programming for the Windows operating system and abusing Active Directory. Greg is an active member of the following organizations: Cloud Security Alliance, the Right Place, American Corporate Partners, West Michigan Technology Council. He regularly appears in the news discussing cyber warfare and the impact of Chinese APTs on America's critical infrastructure. Greg has the following certifications: GXPN, GCPN, CRTP, CISSP, GWAPT, and GSEC.

John Stigerwalt , White Knight Labs

John has worked as blue teamer, vCISO, developer, senior penetration tester, and red team lead. John served as the F-Secure red team lead for the western hemisphere. He has led long‐term red team engagements in highly complex Fortune 500 companies. He has worked together with Microsoft to increase kernel security for the Windows operating system. He has led training at BlackHat, DerbyCon, and Wild West Hackin’ Fest. He is the author WKL’s Advanced Red Team Operations course (ARTO). John has the following certifications: OSCP, OSCE, CRTP (Certified Red Team Professional), CRTE (Certified Red Team Expert), and SLAE (Assembly Language and Shellcoding). John is known as one of the most talented offensive cyber security experts in the world and can do whatever is asked of him on a computer.

NotSoSecure - Hacking and Securing the Cloud

As cloud innovation gives birth to new technologies and new threats, now is the time to modernize your cloud security skills and bring them up to the industry standard. Join this hands-on, 4-day course to push your cloud hacking and vulnerability remediation skills to the next level and widen your career prospects. Get your hands dirty with our popular virtual labs and learn from experienced, practicing penetration testers with a legacy of training at Black Hat. Click here for Training Syllabus

Manish Rohilla Principal Security Consultant, NotSoSecure

Manish is involved in day-to-day Penetration Testing for a broad range of NotSoSecure clients, which includes infrastructure and web application Penetration Testing. Typically, clients are Fortune 500 companies and major organisations based in Europe and the US. Client work tends to be carried out in a small team of usually three highly collaborative NotSoSecure Security Consultants, although some work that he involved with is done solo depending on the size of the project. Manish developed an interest in Computer Science at college, beginning with programming and .Net, moving on to networks and Cybersecurity. This led to university studies and a degree in Electronics & Communications Engineering and in 2018 a Masters in Cybersecurity. Before joining NotSoSecure, he worked in Digital Forensics, which involved extracting artifacts from systems that had been used in a criminal activity. In his spare time, he keeps his skills and industry knowledge up-to-date, undertaking various items of personal research in Penetration testing, Cloud Security and DevSecOps. He has also participated in various Conferences like Black Hat, Bsides and Local Null Chapters.

Practical Burp - Advanced Tactics

Do you feel pretty good about your Web Application Security testing methodology, but think you might be able to get more out of your tools? Years of experience providing instruction on the process of conducting Web Application Security assessments has made it clear. Even the most experienced testers lack a complete understanding of everything that is available in the industry's #1 Web Application Security testing tool: PortSwigger's Burp Suite Pro. It's time to fix that with Practical Burp Advanced Tactics (PBAT). Click here for Training Syllabus

Tim Tomes (Lanmaster53) Burp Suite Master, PractiSec

Application Security Engineer with extensive experience in the information technology and security industries. Experience ranges from software development to full-scope penetration testing (red teaming) as both a technician and leader for both the United States Military and private industry. Currently specializing in application security as a trainer and practitioner of web application penetration testing and secure software development.

Examen radioamateur Compétence de Base / Amateur Radio Basic Competency Exam

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

Une opportunité inestimable pour ceux qui aspirent à obtenir leur licence de radioamateur - passez l'examen pour la compétence de base durant Northsec!

An invaluable opportunity for those aspiring to obtain their amateur radio license - take the basic competency exam during Northsec!

Location: Workshop 2 room located in Community Room

Prevent First, Detect Second: An Open-Source Approach

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

As the authors of this talk can testify from experience, it feels almost impossible to detect cyberattacks, let alone stop them. Alert fatigue and a shortage of automation, skills, and personnel further exacerbate this problem, emphasizing the need for prevention mechanisms that allow defenders time to investigate threats.

Incident response, even if automated, is best done after an attack has already been thwarted. Easier said than done? Not really if you use the right tools!

The right tools we will discuss in this talk are our open-source RPC-Firewall and LDAP-Firewall. First, we prevent! We show how these tools can be used in every Microsoft domain environment to halt innumerable attacks throughout the kill chain. We can stop the initial stages of an attack by preventing domain enumerations via SharpHound, BloodHound.py, SOAPHound, and various LDAP queries. We can also prevent numerous types of privilege escalation and lateral movement attacks, including DCSync attacks, remote DCOM execution, PsExec, PetitPotam attacks, Coercing attacks, and many more…

Second, we detect! Our open-source tools write Windows events to the local event logs, which can be easily forwarded to your local SIEM. The RPC Firewall and LDAP Firewall also have their own Sigma rules published for them, making detection engineering even simpler. Using Sentinel as an example, we show how these events can be ingested into any SIEM, how baselines can be easily created, and how detection rules are formulated.

Finally, we will summarize with RPC and LDAP firewall internals, which will help guide the security community on how to better contribute, expand, and customize these open-source tools to bring more value to the community.

Dekel Paz ,

Security Researcher with over 15 years of experience in Cybersecurity and software development. I’ve been on both sides of the fence – leading Offensive and Defensive security teams in the past.

Sagie VP Research, ZeroNetworks

Sagie is a defensive security researcher, leading the Zero-Labs team as VP of Research @ Zero Networks. With a bachelor's in Electrical-Engineer, Sagie started out designing and breaking-up communication schemas in the Intelligence unit of the military. After his service, Sagie went on to perform research on diverse topics, introducing new attacks techniques such as the "man-in-the-cloud" attacks and supply chain compromises against container developers. In recent years, Sagie is focused on research that delivers practical solutions to security teams, mainly in the form of open source security tools.

Location: Workshop 2 room located in Community Room

Mastering Exegol

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

Apprenez à réaliser des tests d'intrusion de manière sécurisée, professionnelle et efficace avec Exegol. Prenez une longeur d'avance en suivant ce training qui se concentrera sur la manière dont les professionnels peuvent facilement configurer et utiliser leur environnement de test d'intrusion, basé sur Docker, en quelques minutes, sans difficulté. L'époque des tests d'intrusion non professionnels, non sécurisés et laborieux est révolue.

Charlie Bromberg (Shutdown) Head of Pentest Service Line, Capgemini

Creator of The Hacker Recipes and Exegol. Creator or contributor to many other projects. Leading ethical hacking offerings for Capgemini France. Passionate about Active Directory.

Mathieu Calemard du Gardin (Dramelac) Red Teamer,

Red Teamer and co-creator of Exegol

Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room

Toolbox for reverse engineering and binary exploitation

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

The objective of the workshop is to learn how to use some powerful but intimidating tools while reverse engineering IOT devices: Angr, Unicorn and Qiling.

The workshop aim to show common use cases for each of these tools and also their limits.

To that end, the workshop will propose the following exercices:

Decipher XOR encrypted strings with Angr
Automated buffer overflow exploitation with Angr
Emulation of arbitrary function or code blocks with Unicorn
Binary emulation with Qiling
Complete device emulation after firmware extraction with Renode

Marc-André Labonté ,

Marc-andre Labonte was a system administrator for more than a decade at the McGill Genome Center while it was known as the McGill University and Genome Quebec Innovation Center. There, he took part in the design, deployment, operation and maintenance of the data center as it went through multiple upgrade cycles to accommodate ever powerful high throughput genome sequencers coming to market.

Then, he joined the ETTIC team at Desjardins in 2016 as infrastructure penetration tester. Currently doing vulnerability research on IOT devices, he also presented "Automated contact tracing experiment on ESP Vroom32" workshop at NSEC in 2021. His work is motivated by curiosity and a strong sense of personal privacy in a world of connected devices and data hungry organizations.

Location: Workshop 2 room located in Community Room

How crypto gets broken (by you)

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

This is an introduction to crypto: building blocks, protocols and attacks on them. We cover: encoding vs encryption, hashes, ‘classic’ crypto, stream ciphers, block ciphers, symmetric crypto, asymmetric crypto, has attacks, classic crypto attacks, stream cipher attack, block cipher attack models, ECB attacks, crypto protocols, digital signatures, message authentication code, nonces, simple authentication, challenge response, simple authentication attacks (key collisions, key extraction and extension, replay, valet, bad counter resync), MAC attacks, digital signature attacks, pubkey substitution, challenge response attacks (middleperson attack, UDS style seed-key predictions), WPA2 password cracking, WPA2 key reinstallation, WPA2 key nulling, TLS/SSL middleperson attacks, SWEET32, DROWN, logjam, POODLE, UDS seed-key exchange attacks (reverse key algorithm, lift key algorithm, solve for unknowns, retry-retry-retry, brute force, glitch past).

Tools covered include: rumkin.com, hashcat, john the ripper, binwalk, radare2, binvis.io, Veles, airocrack-ng, mitmproxy, MITMf.

The workshop is a ‘101’ level: geared for people good at computers but maybe no knowledge of cryptography. There will be minimal math (I promise). We’ll talk mostly about how to break bad crypto and bad crypto algorithms with 10-15min hands-on sessions integrated into 4 hours of workshop: Decrypt ‘Crypto’, Break Hashes, Break Crypto, Visualize Crypto.

We will explore three applications of the building blocks and attacks also. Towards the end we tie-in the building blocks and attacks into how the following crypto protocols get broken: WPA2, TLS and UDS Seed-Key exchange (from automotive). Please join us for an intro-level exploration of cryptography building blocks, protocols and how to attack them. And, as always, crypto means cryptography.

Ben Gardiner , Yellow Flag Security Inc.

Mr. Gardiner is an independent consultant at Yellow Flag Security, Inc. presently working to secure commercial transportation at the NMFTA and connected transportation with TMNA. With more than ten years of professional experience in embedded systems design and a lifetime of hacking experience, Gardiner has a deep knowledge of the low-level functions of operating systems and the hardware with which they interface. Prior to YFS Inc., Mr. Gardiner held security assurance and reversing roles at a global corporation, as well as worked in embedded software and systems engineering roles at several organizations. He holds a M.Sc. Eng. in Applied Math & Stats from Queen’s University. He is a DEF CON Hardware Hacking Village (DC HHV) and Car Hacking Village (CHV) volunteer. He is GIAC GPEN certified and a GIAC advisory board member, he is also chair of the SAE TEVEES18A1 Cybersecurity Assurance Testing TF (drafting J3061-2), contributor to several ATA TMC task forces, ISO WG11 committees, and a voting member of the SAE Vehicle Electronic Systems Security Committee. Mr. Gardiner has delivered workshops and presentations at several world cybersecurity events including the Cybertruck Challenge, GENIVI security sessions, Hack in Paris, HackFest and DEF CON main stage.

Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room

Machine Learning For Security Professionals: Building And Hacking ML Systems

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

Our training provides an intuitive introduction to machine learning for security professionals with no prior knowledge of mathematics or ML. In the ML4SEC section attendees will gain hands-on experience building MLpowered defensive and offensive security tools using popular libraries like Tensorflow, Keras, Pytorch, and sklearn. We’ll cover the entire ML pipeline, from pre-processing data to building, training, evaluating, and predicting with ML models. In the SEC4ML section we’ll address vulnerabilities in state-of-the-art machine learning methodologies, including adversarial learning, model stealing, data poisoning, and model inference. Participants will work with vulnerable ML applications to gain a thorough understanding of these vulnerabilities and learn possible mitigation strategies. Our training provides practical knowledge that security professionals can apply in their work

Sagar Bhure Senior Software Engineer, F5

Sagar Bhure is a highly accomplished Security Researcher with a proven track record of excellence in his research on security. He is a filed patent holder with the US for his innovative work on ML and Security and has published several papers on the subject in top-tier journals. He currently leads various projects at OWASP, including the prestigious "ML Security Top 10" , an OWASP flagship project. Sagar has spoken at several industry-leading international conferences, including Hack in Paris, BlackHat, OWASP, and APISecure. He is regarded as a respected thought leader in the cybersecurity community, frequently invited to speak at conferences and workshops on topics related to offensive and defensive security. Sagar’s engaging presentations have helped to educate security professionals with cutting-edge research and tools to strengthen their security toolkits.

Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room

Reversing Rust Binaries: One step beyond strings

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

Are you a seasoned reverse engineer, but you tremble when a Rust binary lands on your desk? When you encounter a Rust binary, do you just run strings on it and hope for the best?

We will take a single problem - string recovery from a Rust binary - and uses it as an approachable starting point for exploring reversing Rust binaries. We will cover:

What are the practical steps we need to take to recover strings? How are strings represented in memory, passed between functions, and manipulated throughout the program?
Once we recover the strings, what do the strings mean? What can the strings we recover tell us about the compiler, language runtime, standard library, and third-party libraries in the binary?

This workshop is intended for reverse engineers and malware analysts who are familiar with reversing C or C++ binaries, but who are unfamiliar with the Rust programming language.

Cindy Xiao Senior Security Researcher, CrowdStrike

Cindy Xiao is a security researcher who works primarily on malware reverse engineering, in support of cyber threat intelligence reporting. Cindy enjoys learning from other security practitioners (both offensive and defensive), developing tools to help with analysis, and mentoring others.

Location: Workshop 1 room located between Vieux-Montreal hall and Ville-Marie room

Exploiter Ansible WorX et tout le reste

Capacity: 45

Workshops are first-come, first-serve and have limited capacity. Some workshops may be streamed for additional passive participation.

Ansible WorX (AWX), la version libre de Ansible Tower, sert à gérer des serveurs à distance de façon centralisée. L’application permet de simplifier la gestion des serveurs en s’appuyant sur la puissance de Ansible et en ajoutant des fonctionnalités de gestion d’inventaire et d'autorisations. Cependant, qui dit centralisation, dit souvent unique point de rupture.

Pour les attaquants, AWX est une cible de choix. Si des accès à la plateforme sont compromis, il est primordial de savoir l’auditer. Il serait facile de causer des incidents et des pertes de service, et c’est à éviter à tout prix. Ceci-dit la récompense de l’utilisation des accès obtenus se compte souvent en dizaines de serveurs compromis. Il s’agit donc d’ un impact majeur pour une organisation.

Dans cet atelier, vous apprendrez les différents concepts reliés à AWX et Ansible. Vous apprendrez également à utiliser des accès à AWX dans l’objectif de compromettre les serveurs gérés par la plateforme. Divers scénarios et méthodes seront abordés pour être prêt à toutes éventualités.

Dans le but d’un atelier le plus fluide possible, s’il-vous-plaît, pré-installez AWX CLI.

Simon Lacasse Pentester,

Simon Lacasse travaille comme testeur d'intrusions chez Desjardins, avec un focus sur des tests organisationels orientés par objectifs. Il est très intéressé par la sécurité web et d'infrastructure. Équipé d'une formation en ingénierie logicielle, il aime créer ses propres outils pour résoudre les différents défis qu'il rencontre. Lorsque possible, il aime redonner à la communauté en faisant de ses outils des logiciels libres. Simon est également un ancien membre du club de sécurité informatique de Polytechnique Montréal, PolyHack/PolyHx.

(Bio de Charl-Alexandre en attente.)

Charl-alexandre Le Brun Penetration Tester, Desjardins

Je suis un passionné de l'informatique, ce domaine est ma passion et mon métier. Je fais des tests d'intrusion depuis quelques années et sur le côté j'aime entreprendre des recherches ou des projets. Que ce soit identifié des vulnérabilités ou construire des outils, je vais toujours suivre ma curiosité.

Location: Workshop 2 room located in Community Room

Gaming on the video wall

Smash, Mario Kart, who knows...

Location: Ville-Marie Hall

Registration - Thursday/Jeudi

Refreshments sponsored by KoaSec // Rafraichissements grâce à KoaSec

KoaSec

Location: Ballroom

Ouverture du CTF de la commune // CTF Opening

Ouverture du service de garde // Day care opens

🥐 ☕ 🥯 🧃 Breakfast sponsored by Corsek // Déjeuner grâce à Corsek

Corsek