Again, RandoriSec was at Hack In The Box for the 2019 edition in Amsterdam! It was really great! The first 3 days of the event are dedicated for the trainings. About that, we heard that the training from Nicolas Grégoire (aka @Agarri) was really great and got very good feedback from the attendees. If you want to improve your skills on Burp Suite Pro, you should attend this training.
La semaine dernière j’ai participé à la table ronde de la conférence du CLUSIF “Gestion des incidents de sécurité : résilience et amélioration.” Mon intervention présentait un travail de recherche effectué en 2016-2017, qui peut se résumer par une question: comment éviter que des biais cognitifs ou organisationnels n’impactent la gestion de la sécurité? En général les décisions en sécurité se prennent sur la base d’avis d’experts, de fournisseurs, de benchmarks ou de discussions avec les pairs.
The March 23th, Guillaume Lopes gave a talk at BSides Dublin about how to bypass the payment on Google Play Billing API. Synopsis: In 2017, the estimated global in-app purchase revenue was projected to exceed $37 billion. Just in the Google Play Store, for 2018, more than 200 000 apps are offering in-app purchases. However, the Google Play Billing API is not offering a sufficient level of protection in order to ensure the security of the payment transactions.
RandoriSec was at the SSTIC conference in Rennes, France. SSTIC (Symposium sur la sécurité des technologies de l’information et des communications in French) is an old security conference which started in 2003 and the majority of the presentations are in French! This year it was the 16th (0x10) edition occurring at the Couvent des Jacobins, an old convent. Most of the slides and the videos are available at the SSTIC website:
RandoriSec was at the Amsterdam 2018 edition of Hack In The Box and… IT WAS A BLAST ! It has been over a month and many tweets, write-ups and even the full slides (https://conference.hitb.org/hitbsecconf2018ams/materials/) have been published so we won’t cover details here but we just wanted to say a few words about it. The agenda was great with two main conference tracks, one dedicated track for the labs and one additional, free and open to public, track:
We will be speaking about Industrial Hacking at DeepINTEL in Vienna this week! Here is the pitch: A few months ago a client asked us to assess the security of the ICS (Industrial Control Systems) of a brand new datacenter. As we were no industrial guys we discovered a whole new world and we tried and failed many times before owning the system. ”_Industrial DIY_“ tries to show how a small team of pentesters managed to assess the security of industrial systems (ICS/SCADA/BMS) and how to protect these critical infrastructures against a few major threats.