🚧 UNDER CONSTRUCTION 🚧

 

 

CALENDAR
 

A   B   C   D   E   F   G   H   I   J   K   L   M   N   O   P   Q   R   S   T   U   V   W   X   Y   Z

A

GIACOMO ALESSANDRONI 'Jackaless'

Caesar's and Vigenère's ciphers are an excellent exercise for those who want to discover the basics of cryptography and cryptanalysis, without computers. Successful educational experiences with primary school children will be illustrated under two headings: writing a message that can pass the prying eyes of parents; decoding a message written by a classmate. With the metamorphosis from lesson to challenge (and opportunity), meanwhile the students learn the fundamental techniques of cryptography, the activity turns into a pretext to dispel fake myths: from "I have nothing to hide" to "my data already have them anyway", building a bridge between IT and civic education, not at all obvious.

Language of the talk: ITALIAN

VITO ALFANO

This is a case of an investigation conducted in collaboration between security researchers regarding a post on a well-known social network, which erroneously announced a campaign launched by an APT group, which began as an analysis of cyber threat intelligence and concluded with the discovery of a wider cybercrime campaign involving various types of entities, including several private security companies and Interpol.

Language of the talk: ITALIAN

Speech co-taught with Marco Di Costanzo

MOHAMMADREZA ASHOURI

In an era where data breaches and privacy concerns are on the rise, zero-knowledge cryptography offers a groundbreaking approach to securing storage systems. This presentation will provide an in-depth look at how zero-knowledge proofs work and their potential to revolutionize data security. We will explore practical applications, demonstrating how zero-knowledge techniques can ensure data integrity and confidentiality without compromising usability. Attendees will gain insights into implementing these cryptographic methods to create robust, privacy-preserving storage solutions. By the end of this session, you’ll understand how to leverage zero-knowledge cryptography to build systems that protect user data from unauthorized access while maintaining trust and transparency.

Language of the talk: ENGLISH

MOHAMMADREZA ASHOURI

In our interconnected world, the security of the food supply chain has become a critical concern. This presentation dives into the various digital threats that can disrupt the journey of food from farm to table. We'll explore real-world examples of cyberattacks targeting food production, processing, and distribution, highlighting the vulnerabilities at each stage. Attendees will learn about the latest technologies and best practices to safeguard against these threats. We'll discuss how integrating cybersecurity measures into every aspect of the supply chain can prevent potential crises, ensuring the safety and integrity of our food supply. Join us to understand the importance of robust digital defenses in maintaining a secure and resilient food supply chain.

Language of the talk: ENGLISH

ANDREA AZZALIN 'Mangusta'

The aim of this talk is to share the story of how I became aware of and conducted analyses on the group known as UNC4990, which has a particular focus on victims in Italy, using infected USB drives as their attack vector. Through the interdisciplinary activities of Threat Hunting, Malware Analysis, and Threat Intelligence, the modus operandi of this complex malicious setup will be illustrated. Additionally, the talk will demonstrate the importance of the synergy of these activities, which is essential for examining emerging groups that use innovative and unconventional techniques.

Language of the talk: ITALIAN

B

DAVIDE BARALDI

The extreme security of Bitcoin can require deep cryptographic knowledge. In our country, non-technicians often spread the idea that the highest level of Bitcoin self-custody is based on Hardware Wallets. However, they can become vulnerabilities in the custody chain of your crypto assets. If you use H.W. you must be aware that you expose yourself to vulnerabilities in the generation and storage of the mnemonic that cannot be mitigated.

Language of the talk: ITALIAN

GIOVANNI BARTOLOMUCCI

This proposal presents a comprehensive session designed to equip security professionals with the technical knowledge and practical skills necessary to secure OAuth2 and OpenID Connect implementations. The seminar delves into the technical aspects of OAuth2 grant flows, highlighting potential security risks associated with misconfigurations. We will explore tokens' properties, emphasizing the importance of defining granular scopes to minimize privilege escalation. Real-world examples of vulnerabilities related to OWASP "A07 - Identification and Authentication Failures" will be analyzed, demonstrating how insecure OAuth2/OIDC configurations contribute to this critical threat category.

Language of the talk: ENGLISH

Speech co-taught with Stefano Maistri, Giuseppe Porcu e Mattia Zago

DAVIDE BERARDI

In this talk, we will explore advanced program tracing techniques on Linux, with a particular focus on tools such as bpfcc, perf, execsnoop, gdb, falco, and lesser-known alternatives. The talk will provide a comprehensive overview of how this ecosystem of tools can be used to monitor and analyze program performance and behavior, identify bottlenecks, resolve complex problems, and aid in reverse engineering – capabilities that were previously lacking in Linux. We will illustrate the key differences between these tools, their ideal use cases, and best practices for their implementation. By the end of the talk, participants will have a clear understanding of the available options for tracing on Linux and how to effectively apply them in their projects. The slogan of the talk is: if you have ever asked yourself "How can I get a list of all the commands that are executed on Linux when I launch Firefox?" or similar questions, this talk is for you!

Language of the talk: ITALIAN

CHRISTOPHER BIANCHI 'calfcrusher' - HACKTIVE SECURITY

Today, many hackers from the 1990s have become cybersecurity experts, earning substantial pay from companies to protect their systems. One of the most famous was undoubtedly Kevin Mitnick. Through the iconic 1994 Christmas attack on Shimomura, we’ll explore how curiosity, passion, and knowledge shaped the past and will influence the future. By retracing this historic showdown, we aim to uncover and present the original spark that drives something in each of us: those seeking a challenge, those feeling highly skilled or aspiring to be, and those questioning where we're headed, looking back for answers. Born from a generational meeting, we move from the particular to the universal, asking together with the giants who came before us about our future.

Lingua del talk: ITALIANO

Talk tenuto insieme a Riccardo Degli Espositi 'partywave'

STEFANO BIOTTO 'sgrum0x' - BEAR IT

In this presentation, we will explore an XSS (Cross-Site Scripting) vulnerability discovered during a secure code review prior to the release of an internal web application.

We will start with the basics, explaining what XSS is, how it works, and the risks it poses. Next, we'll analyze the application’s code, highlighting how inadequately validated input can expose the system to an attack. After understanding the vulnerability, we'll shift focus to OAuth, the authentication system used by the application, to understand how this technology interacts with security issues. Finally, we’ll return to the code to examine a successful exploit and conclude with an interesting vulnerability in the PHP backend.

This presentation offers a blend of theory and practice, ideal for those wanting to dive deeper into the challenges of web security.

Lingua del talk: ITALIANO

GIORGIO BONFIGLIO

In this workshop, we will discuss infrastructural techniques (those that do not require changes to the application) for protecting web applications against common threats. We'll start by simulating a data exfiltration attack on an OWASP Juice Shop environment, then move on to implementing countermeasures (a Web Application Firewall and other solutions) and – if all goes well – we'll demonstrate how the same attack will no longer be effective.

We'll do all of this in a sandbox provided by us, so all you need to bring is your brain and some kind of computer with a browser and a shell.

Lingua del workshop: ITALIANO

C

FABIO CARLETTI 'Ryuw'

IT systems testing is increasingly important, ZAP Attack Proxy is a free and open source tool for researchers and cybersecurity specialists. The project's mission is focused on web apps and web portals through multi-level attack techniques. The Plug-in section of the marketplace expands the possibilities of operating in a cross-functional manner.

Language of the talk: ITALIAN

LORENZO COCOCCIA 'lopoc'

Based with Kripkestein's paradox, we will discuss the implications of the use of AI in adjudication on the rule of law. We will see how large language models (LLMs) interpret text and how they can be manipulated through offensive prompt engineering or "jailbreaking". By this we mean crafting prompts that force LLMs to respond in ways that were not desired by their programmers, and more specifically to apply rules that are different from the ones that the LLMs were expected to apply. This is instructive not only because it can show us some of the problems that AI driven jurisdiction is likely to raise but also because it creates a valuable framework to discuss general rule to follow. We will conclude with a practical exercise where we attempt to "hack" an LLM which was given the task act as an AI judge and apply a certain rule to a case, Participants will craft arguments designed to exploit potential hallucinations and weaknesses in the way AI processes rules.

Language of the talk: ITALIAN

Speech co-taught with Michele Ubertone

MATTEO CREATI

Tokens are at the center of OAuth 2.0 identity platforms, such as Entra ID. To access a resource (for example, a web application protected by Entra ID), a user must present a valid token. Attackers steal tokens so they can impersonate users and access your data for as long as that stolen token lives. To do this, they get access to where a token is stored (on the client, in proxy servers, or in some cases in application or network logs) to acquire it and replay it from somewhere else.

Language of the talk: ITALIAN

D

MARCELLO DAL DEGAN - DIGIMETRICA

In an increasingly connected world, protecting the digital perimeter is crucial for organizational security. This talk delves into the importance of External Attack Surface Management (EASM) and Cyber Threat Intelligence (CTI) in monitoring and defending exposed digital assets. We will explore how an effective combination of these approaches can help organizations detect, understand, and mitigate cyber threats, ensuring a robust defense against ever-evolving cyber-attacks.

Language of the talk: ITALIAN

Speech co-taught with Raffaello Parisi

MASSIMO D'ALESSIO

The CanBus is a solid and robust protocol, but also old and insecure. In recent years it has been exploited by criminals to steal different types of cars. With a very basic approach, we want to analyze the vulnerabilities that afflict this technology and implement a security layer that does not impact the performance of the original protocol.

Language of the talk: ITALIAN

MICHELE DALLACHIESA

This talk introduces a novel mechanism for verifying the integrity of machine learning model predictions. Inspired by proof-of-computation and computation-pipeline concepts, it allows inference endpoints to generate cryptographic proofs demonstrating that a model genuinely produced specific predictions.

Language of the talk: ENGLISH

MIRCHA EMANUEL D'ANGELO 'ryuujin'

I will guide you on a journey to show you how to accelerate application development with Laravel and Filament. We will explore how Filament, with its powerful admin interface, seamlessly integrates with Laravel, allowing for the creation of complex applications in a simple and rapid manner. Through practical examples and best practices, we will demonstrate how these technologies can reduce development time and enhance productivity.

Language of the talk: ITALIAN

RICCARDO DEGLI ESPOSITI 'partywave' - HACKTIVE SECURITY

Today, many hackers from the 1990s have become cybersecurity experts, earning substantial pay from companies to protect their systems. One of the most famous was undoubtedly Kevin Mitnick. Through the iconic 1994 Christmas attack on Shimomura, we’ll explore how curiosity, passion, and knowledge shaped the past and will influence the future. By retracing this historic showdown, we aim to uncover and present the original spark that drives something in each of us: those seeking a challenge, those feeling highly skilled or aspiring to be, and those questioning where we're headed, looking back for answers. Born from a generational meeting, we move from the particular to the universal, asking together with the giants who came before us about our future.

Lingua del talk: ITALIANO

Talk tenuto insieme a Christopher Bianchi 'calfcrusher'

VITO DE LAURENTIS 'Trust_No_One'

This presentation traces my personal journey in the innovation of offensive cyber operations, using cloud infrastructure with Terraform and the Infrastructure as Code (IaC) paradigm. The architectures introduced, exploiting the HashiCorp Configuration Language (HCL), integrate with advanced command and control, networking and anonymisation tools, and are able to guarantee scalability and security. Automation of configuration and management of cloud resources can enable more effective complex offensive operations.

Language of the talk: ITALIAN

DONATO DE MEO

Evolution of a network, how networks have changed over the years and how they will become.

Language of the talk: ITALIAN

MARCO DI COSTANZO

Questo è un caso di un'indagine condotta in collaborazione tra ricercatori di sicurezza riguardo a un post su un noto social network, che annunciava erroneamente una campagna lanciata da un gruppo APT, iniziata come un'analisi di intelligence delle minacce informatiche e conclusasi con la scoperta di una campagna di criminalità informatica più ampia coinvolgendo vari tipi di entità, inclusi diverse aziende di sicurezza private e Interpol.

Language of the talk: ITALIAN

Speech co-taught with Vito Alfano

ETTORE DI GIACINTO 'mudler'

The talk explores how LocalAI offers an Open Source, fully locally manageable alternative to closed and proprietary artificial intelligence services such as OpenAI and Claude. In a context where privacy is increasingly paramount, and where processing sensitive data is important, LocalAI stands as a completely free solution that runs on any hardware. LocalAI supports offline execution without expensive hardware and is also fully compatible with the OpenAI API, allowing an easy transition for developers. We will discuss LocalAI's architecture, its capabilities in text generation, workload distribution, speech synthesis and audio transcription, and how to build customised assistants, even with low-cost hardware.

Language of the talk: ITALIAN

ETTORE DI GIACINTO 'mudler'

We will talk about security in edge computing and Kairos (kairos.io). Kairos is an open source project, now part of the CNCF/Linux foundation to use Kubernetes and Linux in edge computing environments, where security is never a given. Through the implementation of technologies such as Secure Boot, Trusted Boot, TPM and disk encryption, Kairos transforms Linux into an operating system that is resistant to physical attacks (Evil maid attacks) and ideal for handling the challenges of environments that are considered insecure. In this talk we will look at how we can defend against physical attacks to protect the confidentiality of data in edge computing environments.

Language of the talk: ITALIAN

LORENZO DINA

A critical retrospective of lessons learnt 20 years ago, compared with today's technological developments and future prospects. A semi-serious journey through the past, present and future of cybersecurity.

Language of the talk: ITALIAN

MIRKO DI SALVATORE

Computer forensics has historically been characterised by extensive and manual investigative processes. This talk introduces an innovative approach based on advanced computational models to transform the field. We present f-T5, a general-purpose linguistic model optimised for digital forensic applications. f-T5 has been refined on specialised forensic data, specifically curated given the scarcity of public resources in the domain.

Language of the talk: ITALIAN

Speech co-taught with Nicolò Monti

MARCO D'ITRI

Marco will explain his own experiments to implement factory reset in Debian, and more generally in mainstream distributions: what already works, what is missing, and what hacks^Wstrategies can be tried to develop this mechanism gradually and without the need to involve the entire distribution. Being able to reset a system by deleting everything via /usr is interesting for managing containers, hardware appliances and more.

Language of the talk: ITALIAN

MARCO D'ITRI

Marco will systematically analyse the history and state of Internet censorship in Italy and compare the situation with that of other countries. The main mechanisms for circumventing Internet censorship systems will be briefly discussed.

Language of the talk: ITALIAN

LUCA DI VITA

Hello CVEs, my old friends I've come to deal with you again Because a backdoor softly creeping... Ops, sorry, we were singing out loudly. That's something we keep doing everytime a new vulnerability breaks in our daily routine. Lately, that has happened because of our software's dependencies, more and more often. Log4J, you say? Oh, well, let's not forget about XZUtils! Supply chain attacks, they call them. We started dealing with them to the rythm of SLSA (read "salsa"), but then we noticed that we could do more. A lot more! And we turned our malicious binaries into...well, waveforms. And we started rocking them! By reading those binaries like if they were normal waveforms, and by analyzing them with some math (Cepstum, Fourier series, etc.) we created a model that aims to detect if a dependency is malicious. And also, to classify it by the type of malware. Fascinating, isn't it? The sound of malware...

Language of the talk: ITALIAN

Speech co-taught with Gregorio Palamà

JOHN DOE

There are several military satellites in geostationary orbit and some of these are now used more often by pirates than by legitimate users. Let us join the pirates by listening and trying to transmit to these satellites, hearing our signal coming back down to earth with the fascinating delay of about half a second.

Language of the talk: ITALIAN

E

F

ALESSANDRO FARINA

Importance of open-source tools in forensics: The use of open-source or free software tools, preferably licensed under the GPLv3 licence, where the source code is accessible for inspection, should be crucial for acquisition, analysis and investigations in general. Open-source tools offer transparency, allowing experts to verify the integrity and security of the code. They allow code to be inspected to ensure the absence of vulnerabilities or backdoors that could compromise the investigation. Furthermore, open-source tools can be customised to meet specific investigative needs and can be peer-reviewed, improving their reliability and trustworthiness in forensic applications. For many investigation activities and for a large number of cases, experts are unfortunately forced to use tools that are completely closed, from the software point of view, based on proprietary technologies that are impossible to inspect; the only tests that can be performed with these tools are those of cross-checking with other tools (also closed) and/or of comparison with the analysis of devices that have been specially prepared as ‘samples’. This way of working could be called ‘black box’ forensics.

Language of the talk: ITALIAN

AURELIO FORESE - NETSONS

Securing a Kubernetes cluster involves dealing with challenging tasks and several potential intervention area.
Our journey will begin with the analysis of the current Kubernetes security state of art exploring the different options we need to face when operating a cluster.
Then we'll focus on the configuration and use of one of the most well-known solutions: policies engines.
Join us and enjoy your flight over k8s security landscape!

Language of the talk: ITALIAN

CAROLA FREDIANI

With the war in Ukraine, a new type of hacktivism and participation in inter-state cyberwarfare has unfolded. Its model is the Ukrainian IT Army, which for the first time brings together cyber volunteers from all over the world under a (albeit formally indirect) state or government command. That kind of organisation deliberately places itself in an ambiguous terrain, where the state accepts contributions but at the same time distances itself from them. And ambiguous is the status of the participants. But in the Ukrainian conflict there has been no shortage of self-styled hacktivist groups (or cybercrimnals, or both) that seem rather aligned with Russian intelligence, or with the Kremlin's propaganda objectives. There is much confusion under the sky, and it is not even clear how to define all these actors. The only clear fact is that states like to be able to count on cyber armies to support their cyber offensives while maintaining some plausible deniability, or at least not complete accountability. All this within a framework in which private individuals (companies, start-ups, individuals) are assuming an increasingly important role.

Language of the talk: ITALIAN

STEFANO FRATEPIETRO 'SteveDEFT'

False myths and inflated stories about cybercrime tell everything and the opposite of everything, distorting the perception of the reality of the phenomenon. This book was written with the aim of telling real facts and compelling stories where computer security and digital investigations are told using simple and popular language. In each story, Stefano presents a piece of himself and his many years of experience in the field. Cyber attacks, overseas investigations, cases of violence against women and sophisticated viruses will accompany the reader in a series of gripping and incredible adventures whose protagonists seem to come straight out of TV series and blockbuster films.

Language of the talk: ITALIAN

G

MARCO GANDOLFI - Berghem-in-the-Middle

In an ever-evolving landscape of threats and technologies, SOC teams face increasing challenges. This talk provides an overview of the evolution of detection engineering and MITRE ATT&CK-based frameworks for evaluating and enhancing Detection & Response capabilities, while also presenting a methodology applicable to enterprise environments.

Lingua del workshop: ITALIANO

LEONIDA GIANFAGNA

This presentation will introduce the topic of Explainable AI, i.e. the ability to explain artificial intelligence models mostly based on neural networks. This topic is becoming increasingly important with the widespread use of Large Language Models, but do we really know how they work and what their limitations are?

Language of the talk: ITALIAN

Speech co-taught with Enrico Zimuel

ALESSANDRO GRASSI

The book Ada & Zangemann (published under Creative Commons BY-SA) tells the story of the famous inventor Zangemann and the curious geek child Ada. Ada experiments with hardware and software, and discovers how crucial it is for her and others to be in control of technology. The book written by Matthias Kirschner (president of FSFE) has been read to more than 1,000 children (aged six and up) and adults in schools, libraries and other events in recent months. The readings took place mostly in Germany, but were also tried out in Italy. I would like to present the book to you and tell you about the activities at school and the reading experiences in general.

Language of the talk: ITALIAN

H

HackInBo®

HackInBo® Forensic Games will be presented in a condensed format, featuring a training session followed by a hands-on workshop where participants will work, and concluding with an analysis and evaluation of the work done.

The training will focus on identifying, cataloging, and securing devices found at a crime scene.

During the workshop, participants will have access to 3 laptops that need to be properly cataloged.

In the analysis phase, we will review the work together and create a "ranking".

Lingua del talk: ITALIANO

I

J

JAROMIL

On 3 June 2021, the European Commission recommended the creation of a ‘toolbox’ (Toolbox) for the development of ‘wallets’ (wallets) to store the digital identities of European citizens (EUDI, European Digital Identity). The tools provided include an Architecture and Technical Reference Framework, a set of common standards and technical specifications and guidelines. The providers of these portfolios will be public authorities or private sector organisations if recognised by Member States. The operation is led by a group of experts chosen by an organisation called eIDAS (electronic Identification, Authentication and Trust Services) whose mission is to update and strengthen digital identity implementations in Europe, such as the SPID in Italy.

In the slow course of this initiative, which was supposed to be completed with usable results by the end of 2023, a document called EUDI ARF (Architecture Reference Framework) evolved that summarised a series of recommendations on how to implement the architecture, evolving through various versions up to the recently published version no. 4.

The document, however, presents many problems for the privacy and security of citizens, perhaps even more serious than its delays...

Language of the talk: ITALIAN

K

L

VALERIO LUPI 'valerino'

This presentation aims to introduce our new open source project: gULP.
Developed by Mentat, gULP is a cutting-edge tool designed to improve incident response and analysis through simplified log processing.

Some of gULP’s key features include:

- a high-speed multi-processing engine that supports fast ingestion and querying.

- a versatile Python plugin system that supports multiple sources.

- query using custom filters, Opensearch DSL and Sigma Rules.

- full scalability support leveraging OpenSearch and PostgreSQL.

- “collaborative workflows” (aka play co-op with friends)

- an innovative UI which allows for quick recognition of attack patterns and data analysis from multiple sources at the same time, overcoming limitations of existing products.

Language of the talk: ITALIAN

Speech co-taught with Gabriele Zuddas

M

M71A

In an era where technology shapes our daily lives and defines the future of work, it’s crucial to ensure an inclusive and equitable environment for everyone. In this panel, we will explore the visions and goals of the Italian Women in Technology Manifesto, discuss the main challenges women face in the tech sector, and how the manifesto proposes to overcome them through concrete actions, training, and awareness-raising efforts. Together, we’ll look at how each of us can contribute to creating a more balanced tech ecosystem by recognizing and elevating women’s skills and perspectives.

Lingua del talk: ITALIANO

STEFANO MAISTRI

This proposal presents a comprehensive session designed to equip security professionals with the technical knowledge and practical skills necessary to secure OAuth2 and OpenID Connect implementations. The seminar delves into the technical aspects of OAuth2 grant flows, highlighting potential security risks associated with misconfigurations. We will explore tokens' properties, emphasizing the importance of defining granular scopes to minimize privilege escalation. Real-world examples of vulnerabilities related to OWASP "A07 - Identification and Authentication Failures" will be analyzed, demonstrating how insecure OAuth2/OIDC configurations contribute to this critical threat category.

Language of the talk: ENGLISH

Speech co-taught with Giovanni Bartolomucci, Giuseppe Porcu e Mattia Zago

VALERIO MANCINI 'ftp21'

From video signal reconstruction to fault injection on CPUs. This is a bit of the history of satellite hacking. We will discuss what has changed in the last 30 years and try to see if it still makes sense to look for vulnerabilities within Set Top Box.

Language of the talk: ITALIAN

MICHELE MARAZZI

DRAM vendors do not disclose the architecture of the sense amplifiers deployed in their chips. Unfortunately, this hinders academic research that focuses on studying or improving DRAM. Without knowing the circuit topology, transistor dimensions, and layout of the sense amplifiers, researchers are forced to rely on best guesses, impairing the fidelity of their studies. We aim to fill this gap between academia and industry for the first time by performing Scanning Electron Microscopy (SEM) with Focused Ion Beam (FIB) on recent commodity DDR4 and DDR5 DRAM chips from the three major vendors. This required us to adequately prepare the samples, identify the sensing area, and align images from the different FIB slices. Using the acquired images, we reverse engineer the circuits, measure transistor dimensions and extract physical layouts of sense amplifiers — all previously unavailable to researchers. Our findings show that the commonly assumed classical sense amplifier topology has been replaced with the more sophisticated offset-cancellation design by two of the three major DRAM vendors. Furthermore, the transistor dimensions of sense amplifiers and their revealed physical layouts are significantly different than what is assumed in existing literature. Given commodity DRAM, our analysis shows that the public DRAM models are up to 9x inaccurate, and existing research has up to 175x error when estimating the impact of the proposed changes. To enable high-fidelity DRAM research in the future, we open source our data, including the reverse engineered circuits and layouts.

Language of the talk: ENGLISH

NORMANDO MARCOLONGO

Have you always heard of information theory and out of laziness never wanted to look into it? The one formalised by Shannon in the late 1940s? We're going to get a bit of trivia out of the way: from the concept of information to how to compress it. There will be some maths but if you don't like maths, you can't be a computer lover; I promise it won't be difficult though!

Language of the talk: ITALIAN

MARCO MELLETTI e MATTEO MARTELLI

Sonic Vision is an innovative open-source program designed for visual artists, enabling real-time music generation through image analysis. Integrated as a plugin for Krita, one of the most popular digital drawing programs, Sonic Vision interprets color and positional information from the original image as musical events. These events are then rendered as MIDI and can be sent to a synthesizer to create sounds or music that reflect the artist's aesthetic intent while drawing. This approach allows for the exploration of new creative dimensions, combining visual arts and music into a unique synesthetic experience.

Language of the talk: ENGLISH

GIOVANNI MELLINI 'merlos'

With this talk you will be guided through the difficulties and challenges merlos has already faced/is facing/will face approaching security in a full cloud environment.

Language of the talk: ITALIAN

LUCA MERCATANTI

In this presentation, we will explore the universe of the TV series C.S.I. and how modern technologies, from computers and smartphones to cars and drones, can reveal a surprising amount of information about past events. We will learn how to effectively collect and present computer data (spoiler: a screenshot is not enough!), examining the process of seizing and analysing devices and discovering what data is unknowingly stored in every moment of our lives. We will analyse some real cases and discuss the potential of artificial intelligence in the field of digital investigation.

Language of the talk: ITALIAN

TONY MOBILY 'Merc'

In this talk, Merc discusses the origins of Metro Olografix, sharing unpublished anecdotes about early mishaps, adventures, choices—and what would happen if those choices were made today. Merc also talks about his thirty-year cryogenic stasis, what he discovered upon waking up in the world of cybersecurity, and whether the spirit and fun of those earlier times can resurface today despite money, certifications, states, and wars.

Language of the talk: ITALIAN

ANDREI MOLDOVAN

The worlds of astronomy and cyber security share many striking similarities. Just as we try to recognise constellations in the night sky by drawing imaginary lines between the stars, within the world of cyber security we connect scattered data to identify potential malicious actors or interesting new relationships. Galaxies represent clusters of state-sponsored actors, complex and made up of barely recognisable entities. Stars symbolise ‘as-a-Service’ groups, which disseminate low-cost tools, while comets represent hacktivist groups, visible only for brief moments before disappearing. Working in intelligence, I have often found myself facing unforeseen problems and often insufficient data, constantly questioning the validity of my conclusions. This presentation is intended to shed light on the challenges and emotional impacts one can encounter while dealing with a myriad of information with no apparent logical connection. How can we keep our wits about us and make informed decisions in such a complex and chaotic environment?

Language of the talk: ITALIAN

ANDREA MONTI

What has happened to digital activism (assuming we can call it that?) From the golden age of Metro Olografix, cyberpunk.ita, Cybernet, Stramp Network, Freaknet, Shake Edizioni, Forte Prenestino, Joe Lametta, A/I, Alcei up to the fetishisation of rights, buzzwords and the search for institutional integration, digital activism. How Italian digital activism was born bad and ended worse.

Language of the talk: ITALIAN

NICOLÒ MONTI

Computer forensics has historically been characterised by extensive and manual investigative processes. This talk introduces an innovative approach based on advanced computational models to transform the field. We present f-T5, a general-purpose linguistic model optimised for digital forensic applications. f-T5 has been refined on specialised forensic data, specifically curated given the scarcity of public resources in the domain.

Language of the talk: ITALIAN

Speech co-taught with Mirko Di Salvatore

ALFREDO MORRESI 'Rainbowbreeze'

You'd like to tame your home, but you don't feel like accessing 5 different clouds to control 2 light bulbs and 1 shutter, while also letting several overseas governments know how many times you've entered the bathroom?
Then let's learn together how to tinker with Home Assistant, the most popular open source smart home software based on three principles: privacy (control what you share, and with whom), freedom (no restrictions on what devices you use or lock-in) and sustainability (hardware support must last).
We will see how to install it on a RasPi or other SBC, control some IoT components and programme the first automations. All exquisitely local.

 

To participate effectively in the workshop, you must arrive with Home Assistant OS already installed on a medium of your choice:

- On a Raspberry Pi: https://www.home-assistant.io/installation/raspberrypi

- On your own computer using VirtualBox / VMWare / KVM

- Linux: https://www.home-assistant.io/installation/linux

- Mac: https://www.home-assistant.io/installation/macos

- Windows: https://www.home-assistant.io/installation/windows

- On your own computer or board in another way: https://www.home-assistant.io/installation

Once you have chosen an installation method, follow the instructions at the provided links and complete the first boot of Home Assistant, where the ‘Welcome’ screen appears.

 

TALK: Saturday at 15:00 - tent MOV

WORKSHOP: Saturday at 16:15 - Hackspace FREEKEVIN

Language of the talk: ITALIAN

CRISTOFARO MUNE

Fault Injection (a.k.a "glitching") is renown technique for attacking computing devices. Historically, it's been used to bypass security checks or for extracting cryptographic keys (e.g. with DFA, Differential Fault Analysis). Due to the underlying physics, as well as system complexity, Fault Injection outcomes are typically volatile and, to the largest extent, unpredictable. For such reason, attacks have often been carried on in a "glitch 'n pray" fashion In this talk we show how the characterization of a target, along with the visualization and analysis of the obtained data, may indicate behavior emergent at the statistical level, allowing for more precise, reliable and, ultimately, more sophisticated attacks. We will perform a live demo, where an embedded device is characterized and the collected data is visualized and analyzed, showing how Fault Injection can actually be a data driven science, rather than a blind exercise. We will also show how characterization data challenges the widespread belief that "instructions are skipped", yielding results that cannot be explained under such fault model. A different fault model, "instruction corruption" is then discussed along with its implications. We will demonstrate how it then becomes possible to use Fault Injection for achieving full Program Counter (PC) control on any architecture, allowing for arbitrary code execution, by simply controlling the data being transferred by the device. Finally, we will discuss the latest advancements in the field, which allow for arbitrary code execution, even without control on the actual data is not possible. (e.g. attacks to secure boot where firmware is encrypted)

Language of the talk: ITALIAN

N

O

SIMONE ONOFRI

In recent decades, there has been a growing effort to bring identity to the internet and the web. What used to be a place where we identified ourselves with a nickname, now requires our real data. Currently, it is in the hands of governments. The US Department of Homeland Security (US DHS), the European Union and the DMVs are trying to implement ‘real’ digital identities on a large scale in a decentralised manner. In the future, we will have our passport and digital driving licence in a Wallet. But what are the threats to privacy, security and human rights? At W3C, standards undergo security reviews through a Threat Model to understand what is being attempted, what could go wrong and what solutions we can adopt. During the talk, after a brief introduction on Threat Modeling and the reference architecture, we will do an interactive Threat Modeling session by brainstorming. We will use techniques such as OSSTMM, STRIDE, LINDDUN and others to explore the topic together.

Language of the talk: ITALIAN

DAVIDE ORNAGHI - Berghem-in-the-Middle

Nftables, the system that many Linux distros have started using as a firewall, has been targeted by attackers in recent years due to its high complexity and easy programmability. Many 0-days are identified by manual analysis of the source code and, more frequently, by fuzzing with syzkaller, by writing specific grammars defining how to interact with the various subsystems. While effectively covering the creation of rules, the Nftables grammar seems not to consider many use cases of firewall rules, leaving a large attack surface uncovered. This talk will describe how the network stack coverage was introduced in the fuzzer and then solve the problem of incomplete coverage and test the Nftables rules. It will then show the vulnerabilities found using this technique and related exploitation ideas for obtaining root privileges on Linux.

Language of the talk: ITALIAN

OSSERVATORIO NESSUNO

Managing TOR nodes can be fun, but also well annoying, so how to do it in Italy? To explain it, we will tell you a story that starts from the Ruby ter trial, arrives in Syria and ends up in a tiled cellar of the Torino Liberty.

Language of the talk: ITALIAN

PAOLO OTTOLINO

Fibonacci + Exploiting + Risk + Protection + Development ‘shaken not stirred’ = combinatorial framework for DevSecOps.
‘Design Shutters: reusable security objects’ proposes an operational model for DevSecOps.
It was created to organise the contents of the course ‘Secure Programming Laboratory’, held at the Politecnico di Bari in the AA 2023-2024, inspired by ‘Design Patterns: Elements of Reusable Object-Oriented Software’.
Design Shutters provides a way of grouping and ordering the 21 elements required to guarantee complete SW protection, through a framework of 21 reusable security objects:
- mapped with the 8 DevOps phases and thus the entire Application LifeCycle.
- managed with the Shewhart cycle (Deming)
- providing operational governance indicators.
Language of the talk: ITALIAN

P

MARCO PAGLIARICCI

Running code in sensitive places is often required, but today security is paramount. We have seen lately how such incredible technologies like WebAssembly and eBPF are gaining a lot of traction because they let you to safely run code in very sensitive places like a client browser, or the Linux kernel, respectively. Can we have some other tools in this matter? Can we have a generic multi-purpose VM written in Rust, that could be embedded in a lot of sensitive places, which will run safe code, and we don't have to worry about crashes or infinite loops? I've tried to answer to this question by writing a programmable keystore in Rust, that acts like a very fast cache, will store your data in-memory, but can also be programmed in a very peculiar query language I've invented. It turns out that this language can be used for many purposes, not only a keystore application!

Language of the talk: ITALIAN

GREGORIO PALAMÀ

Hello CVEs, my old friends I've come to deal with you again Because a backdoor softly creeping... Ops, sorry, we were singing out loudly. That's something we keep doing everytime a new vulnerability breaks in our daily routine. Lately, that has happened because of our software's dependencies, more and more often. Log4J, you say? Oh, well, let's not forget about XZUtils! Supply chain attacks, they call them. We started dealing with them to the rythm of SLSA (read "salsa"), but then we noticed that we could do more. A lot more! And we turned our malicious binaries into...well, waveforms. And we started rocking them! By reading those binaries like if they were normal waveforms, and by analyzing them with some math (Cepstum, Fourier series, etc.) we created a model that aims to detect if a dependency is malicious. And also, to classify it by the type of malware. Fascinating, isn't it? The sound of malware...

Language of the talk: ITALIAN

Speech co-taught with Luca Di Vita

GREGORIO PALAMÀ

Native image di GraalVM offre un ottimo modo per ottimizzare le nostre applicazioni scritta per la JVM e trasformarle in un eseguibile nativo, che garantirà bassi tempi startup, basso consumo di risorse, alte prestazioni. Molte librerie e framework non sono ancora pronti per tutto questo, e questo è un male! Vieni a scoprire il mio viaggio personale nella compilazione nativa di un'applicazione basata su JVM. Vedremo sia le cose belle, così come i dolori, le varie vicissitudini e alcuni dei modi che ho trovato efficaci per risolvere i momenti difficili.

Language of the talk: ITALIAN

AGOSTINO PANICO 'van1sh' - BSides Italy

Nowadays cyber false flag operations have emerged as a sophisticated and deceptive form of cyber warfare. These operations involve malicious actors executing attacks designed to mislead, making it appear that a different group or nation is responsible. By mimicking the tactics, techniques, and procedures (TTPs) of other entities, cyber false flag operations aim to confuse investigators, exploit existing tensions, and manipulate narratives.

The targeting cycle of cyber false flag operations involves gathering intelligence, weaponizing attacks with misleading attributes, delivering these attacks in a manner that reflects another group's style, exploiting vulnerabilities to achieve the operation's objectives, and shaping the narrative to reinforce the deception. This cycle highlights how false flag operations can leverage media manipulation and social platforms to sway public opinion.

To address these challenges, defenders must employ a range of TTPs, including threat intelligence, attribution analysis, incident response, and media strategies. However, these measures can also contribute to confirmation bias and escalation, underlining the need for comprehensive approaches to cyber attribution and international cooperation to mitigate the impact of these deceptive maneuvers.

Language of the talk: ENGLISH

RAFFAELLO PARISI - DIGIMETRICA

In an increasingly connected world, protecting the digital perimeter is crucial for organizational security. This talk delves into the importance of External Attack Surface Management (EASM) and Cyber Threat Intelligence (CTI) in monitoring and defending exposed digital assets. We will explore how an effective combination of these approaches can help organizations detect, understand, and mitigate cyber threats, ensuring a robust defense against ever-evolving cyber-attacks.

Language of the talk: ITALIAN

Speech co-taught with Marcello Dal Degan

ALBERTO PELLICCIONE

Advancements in vision capabilities in Large Language Models are enabling a new type of interaction between GenAI systems and the real world. When these capabilities can be leveraged without the need for cloud compute, privacy-preserving agents can be built to live in and look over our private spaces. We will show how, with relatively limited resources, it's possible to create a conversational monitoring and alarm system that can potentially be expanded to interact with other sensors deployed, for instance, within a smart home.

Language of the talk: ITALIAN

ANGELO PENDUZZU

Critical industrial infrastructures are increasingly in the crosshairs of attackers. Industroyer2 is a sophisticated variant of the Industroyer malware designed to attack and sabotage industrial infrastructures, especially power grids. Detected in 2022, it is distinguished by its ability to communicate directly with industrial control systems (ICS) using specific protocols such as IEC 104. Industroyer2 exploits this connection to send malicious commands, interrupting crucial operations and causing blackouts or physical damage. The malware is modular, allowing attackers to adapt it to different ICS environments. It has been attributed to state-backed hacker groups, highlighting the growing threat of cyber warfare against critical infrastructure. We will begin with a brief introduction, examining how Industroyer2 fits into the broader context of cyber attacks on critical infrastructure. We will see how this malware has been used in state-sponsored operations, highlighting the growing threat of cyber warfare. We will explore its main features, such as its ability to communicate directly with ICS devices using specific protocols like IEC 104, which allows it to send malicious commands and cause significant disruptions in industrial operations. We will then move on to an analysis of Industroyer2's code. Through a technical analysis I will show how the malware is structured, highlighting its modular components that allow attackers to adapt it to different environments.

Language of the talk: ITALIAN

ALESSIO L.R. PENNASILICO 'mayhem'

It’s written as “ESG”, but everyone reads it as “carbon footprint and inclusion”. Essential, of course. But not enough. ESG means organizing to do things well, reducing risks for everyone. Thus cyber, in general, becomes an indispensable tool to ensure that all stakeholders (from the end consumer to the entire supply chain involved) know that their services are reliable and secure, that suppliers know the business is solid and invoices will be paid, and that investors know the stock prices won’t crash, etc. When considering the entire OT/IoT world, it means machinery that doesn’t harm people or pollute due to an attack or malfunction. The hacker mindset of wanting to optimize everything and have perfect products and services, with the utmost protection for all involved parties, plays a fundamental role.

Language of the talk: ITALIAN

MICHELE PIETRAVALLE 'PHCV'

How did Piracy Shield come about? What were the previous attempts? How is it supposed to work? What dangers does it pose to net neutrality and freedom of information? And what could it lead to? The (sad) story of the Italian implementation of state censorship

Language of the talk: ITALIAN

ANDREA POMPILI

When cyber protections do not work, the Cyber Threat Hunting process seems to be the only solution that can identify and subsequently improve the level of protection and resilience of a critical infrastructure: starting with a hypothesis (I suspect something is up), followed by an investigation (this is what is going wrong), up to the definition of an effective detection and response strategy (I know how to find it and then execute the right response). This process has to be applied continuously in a now borderless and ever-changing environment, where even the life cycle of a threat hunting process, to be effective, should at least be constantly aligned with the attacker's times. A data-lake approach oriented towards batch processing for pattern identification may partially solve the need, but there still remains the problem related to the enormous computing power required to stay aligned to the attacker and react in real time to detected kill-chains, a need that cannot be solved only by increasing resources indefinitely. We will then introduce a new approach to Real-Time Cyber Threat Hunting, supported by some field-tested use cases, based on a comprehensive behavioural approach based on statistical and artificial intelligence models that can be combined with dynamic response playbooks, which can be redefined in relation to the feedback received, or deception systems that can slow down the attacker's action and allow further validations to catch up.

Language of the talk: ITALIAN

ANDREA POMPILI

What can you do with your C64 when you realise you're terrible at games? Obviously make your own game. And like a good megalomaniac, not the usual puzzle game, but a shoot-em-up with lots of on-screen enemies, devastating weapons, parallax and lots of levels set in remote worlds. Without any idea of what was in store for me, amidst more or less explicit inspirations, frustrations, ideas and satisfactions, many downsized dreams, but also many unexpected technical tricks, I eventually succeeded... in a world that at the time was very unconnected (at least for me) and in a constant struggle with the limitations of the tools at my disposal and with high school interrogations.

Language of the talk: ITALIAN

GIUSEPPE PORCU

This proposal presents a comprehensive session designed to equip security professionals with the technical knowledge and practical skills necessary to secure OAuth2 and OpenID Connect implementations. The seminar delves into the technical aspects of OAuth2 grant flows, highlighting potential security risks associated with misconfigurations. We will explore tokens' properties, emphasizing the importance of defining granular scopes to minimize privilege escalation. Real-world examples of vulnerabilities related to OWASP "A07 - Identification and Authentication Failures" will be analyzed, demonstrating how insecure OAuth2/OIDC configurations contribute to this critical threat category.

Language of the talk: ENGLISH

Speech co-taught with Giovanni Bartolomucci, Stefano Maistri e Mattia Zago

Q

R

S

DANILO SPINELLA

In the latest iterations of Linux, many features have been added regarding the Boot Process, including a new standard called BLS with support in GRUB2 and systemd-boot, Full Disk Encryption using TPM, and having the entire boot process signed, ensuring system integrity.
Another interesting feature is soft-reboot, which is the ability to reboot the entire userspace, without rebooting the hardware or reloading the kernel like kexec does. In this talk we will talk about these features, and why the major actors are collaborating on them.

Language of the talk: ENGLISH

T

LEONARDO TAMIANO

In 1998, Daniel Bleichenbacher discovered that the use of RSA combined with the PKCS#1v1.5 padding scheme within the SSLv3 protocol could lead to vulnerable scenarios in which it was possible to force the decryption of messages encrypted with the server's public key. The attack is published and a fix is proposed for the next version of the protocol, TLSv1. It was later discovered that that fix was not enough. Over the years, at regular intervals, various versions of the attack are rediscovered. Further fixes and recommendations were proposed, until the latest version of the protocol, TLSv1.3, in which the possibility of using RSA to protect key exchange was removed altogether. The knowledge required to understand the attack in question intersects various areas of interest, including mathematics, computer science and cryptography. This attack is therefore an excellent scenario for analysing how to structure a complex subject in such a way as to help the mysterious activity of teaching as much as possible. The aim of the talk is in fact to analyse, using the attack discovered by Bleichenbacher as a concrete example, what fundamental characteristics a lesson must have in order to be considered useful and meaningful in the context of computer science.

Language of the talk: ITALIAN

ALESSANDRO TANASI - Berghem-in-the-Middle

CodeQL is an advanced static code analysis tool used to identify vulnerabilities and improve software security. In this talk, we will explore the capabilities of CodeQL, demonstrating how it enables development teams and bug hunters to write custom queries in a SQL-like language to analyze source code. We will understand how to use it for bug hunting and vulnerability research activities.

Lingua del talk: ITALIANO

MARTA TARONI

Law in the society of manipulation

Although the Internet is fundamental to our lives, we do not always reflect on the kind of economic transaction we are involved in every time we use it. While when we go to a restaurant or the library we are all quite clear about who pays for the service rendered to us, this is not always as obvious to us when we are on Google, Instagram, TikTok, Tinder, Grindr, Snapchat, LinkedIn, or YouTube. We pay for the restaurant; the municipality, through our taxes, pays for the library, but who pays for the web giants we interface with every day? Although we use the Internet much more often than we go to the restaurant or the library, only a minority of us can give a comprehensive answer to this trivial question. The answer, in its essentials, is as follows. The economic agent operating in the digital sector collects data about us: some of this data is used to improve products and services, while the others are processed to obtain predictive algorithms. Through the extraction of behavioural data, it is possible to address the right stimulus to the consumer at the right time, to induce them to behave online and offline in the way desired by the platform and the advertiser. That the medium most used by mankind should be based on the buying and selling of manipulative power is, so to speak, an accident of history. There is nothing technically necessary in this institutional design. It has never been voted on or designed by fully conscious public policy. Moreover, law has traditionally proved incapable of regulating the Internet effectively, of reducing its manipulative potential and its distorting effects on the public's representation of reality. In this talk, we will use some notions of general legal theory to attempt to explain why this incapacity exists.

Language of the talk: ITALIAN

Speech co-taught with Michele Ubertone

U

MICHELE UBERTONE

Based with Kripkestein's paradox, we will discuss the implications of the use of AI in adjudication on the rule of law. We will see how large language models (LLMs) interpret text and how they can be manipulated through offensive prompt engineering or "jailbreaking". By this we mean crafting prompts that force LLMs to respond in ways that were not desired by their programmers, and more specifically to apply rules that are different from the ones that the LLMs were expected to apply. This is instructive not only because it can show us some of the problems that AI driven jurisdiction is likely to raise but also because it creates a valuable framework to discuss general rule to follow. We will conclude with a practical exercise where we attempt to "hack" an LLM which was given the task act as an AI judge and apply a certain rule to a case, Participants will craft arguments designed to exploit potential hallucinations and weaknesses in the way AI processes rules.

Language of the talk: ITALIAN

Speech co-taught with Lorenzo 'lopoc' Cococcia

MICHELE UBERTONE

Although the Internet is fundamental to our lives, we do not always reflect on the kind of economic transaction we are involved in every time we use it. While when we go to a restaurant or the library we are all quite clear about who pays for the service rendered to us, this is not always as obvious to us when we are on Google, Instagram, TikTok, Tinder, Grindr, Snapchat, LinkedIn, or YouTube. We pay for the restaurant; the municipality, through our taxes, pays for the library, but who pays for the web giants we interface with every day? Although we use the Internet much more often than we go to the restaurant or the library, only a minority of us can give a comprehensive answer to this trivial question. The answer, in its essentials, is as follows. The economic agent operating in the digital sector collects data about us: some of this data is used to improve products and services, while the others are processed to obtain predictive algorithms. Through the extraction of behavioural data, it is possible to address the right stimulus to the consumer at the right time, to induce them to behave online and offline in the way desired by the platform and the advertiser. That the medium most used by mankind should be based on the buying and selling of manipulative power is, so to speak, an accident of history. There is nothing technically necessary in this institutional design. It has never been voted on or designed by fully conscious public policy. Moreover, law has traditionally proved incapable of regulating the Internet effectively, of reducing its manipulative potential and its distorting effects on the public's representation of reality. In this talk, we will use some notions of general legal theory to attempt to explain why this incapacity exists.

Language of the talk: ITALIAN

Speech co-taught with Marta Taroni

V

PIERGIORGIO VAGNOZZI

One of the greatest challenges encountered in the development of cloud solutions is scalability united with reliability. For years, the sceptre of best solution was held by the ActorModel/Akka pair, which however required specific skills and a radical paradigm shift in programming. Fortunately, Microsoft has made the .NET Orleans framework open source and available to the entire community, which, by implementing the Virtual Actor Model usable in C# and F#, makes it easy to scale without having to learn a new language from scratch.
In the session we will briefly look at some theory (Grain, Silos, etc.) and then move on to the dissection of an example application running on a Kubernetes cluster.

Language of the talk: ITALIAN

VECNA

Digital rights is an important field of struggle worth knowing about, where multidisciplinary thinking and hacking can excel. It is also an interesting market and a geopolitical field, where numerous public and private actors compete for space and power, including by funding free software. From cryptography to data retention, from web scraping to reverse engineering and, of course, to the buzzword of this decade, AI: we will talk about how these topics are often mistreated by regulations and distorted by lobbying, but also how hacking or otherwise a mastery of technology can bring a fundamental point of view that can revolutionise the discourse and create change in society. One example starts right here: 8 years ago, the Tracking Exposed project began. It lasted for 7 years, starting from a concept written for MOCA, it arrived in the academy, in European international institutions. The talk will be an opportunity to demonstrate how something born from Italian hacking has contributed to the discourse on digital rights, at the intersection of market, politics, jurisprudence and technology. The hacker community has the power to be a fundamental actor in shaping the struggles for digital rights, and to have an impact: here is how it can be done.

Language of the talk: ITALIAN

W

X

Y

Z

MATTIA ZAGO

This proposal presents a comprehensive session designed to equip security professionals with the technical knowledge and practical skills necessary to secure OAuth2 and OpenID Connect implementations. The seminar delves into the technical aspects of OAuth2 grant flows, highlighting potential security risks associated with misconfigurations. We will explore tokens' properties, emphasizing the importance of defining granular scopes to minimize privilege escalation. Real-world examples of vulnerabilities related to OWASP "A07 - Identification and Authentication Failures" will be analyzed, demonstrating how insecure OAuth2/OIDC configurations contribute to this critical threat category.

Language of the talk: ENGLISH

Speech co-taught with Giovanni Bartolomucci, Stefano Maistri e Giuseppe Porcu

ENRICO ZIMUEL

This presentation will introduce the topic of Explainable AI, i.e. the ability to explain artificial intelligence models mostly based on neural networks. This topic is becoming increasingly important with the widespread use of Large Language Models, but do we really know how they work and what their limitations are?

Language of the talk: ITALIAN

Speech co-taught with Leonida Gianfagna

GABRIELE ZUDDAS

This presentation aims to introduce our new open source project: gULP.
Developed by Mentat, gULP is a cutting-edge tool designed to improve incident response and analysis through simplified log processing.

Some of gULP’s key features include:

- a high-speed multi-processing engine that supports fast ingestion and querying.

- a versatile Python plugin system that supports multiple sources.

- query using custom filters, Opensearch DSL and Sigma Rules.

- full scalability support leveraging OpenSearch and PostgreSQL.

- “collaborative workflows” (aka play co-op with friends)

- an innovative UI which allows for quick recognition of attack patterns and data analysis from multiple sources at the same time, overcoming limitations of existing products.

Language of the talk: ITALIAN

Speech co-taught with Valerio Lupi