Crypto Challenge:
@heidishooligans
Capture the Flag:
@lintile
Hacker Trivia:
@Databeast
No presenters receive personal invites or special concessions. ALL submissions are judged on their own merit.
Travel and personal expenses are not reimbursed by CarolinaCon for any CarolinaCon presenter.
CarolinaCon operates on a tight, non-profit budget, and unfortunately cannot pay any presenter fees beyond the freebies mentioned above.
CarolinaCon also does not provide visa sponsership for visitors outside of the US--either attendees, or speakers.
SPONSORS and/or VENDORS and/or ADVERTISERS:
We don't accept any so please don't bother asking. Capitalism (what you vendor/sponsor types do) and philanthropic knowledge-sharing (what we do) don't mix at CarolinaCon by design. We keep our admission price to the bare minimum to cover our venue and equipment expenses. All of our staff are volunteers who generously donate their time and energy. All of our presenters generously donate their time and talent. The only items sold at CarolinaCon are a limited quantity of single-design CarolinaCon t-shirts....and we only make and sell those because attendees and staff want them (and because they're cool).
CarolinaCon is an annual conference in North Carolina that is dedicated to sharing knowledge about technology, security and information rights. CarolinaCon also serves to enhance the local and international awareness of current technology related issues and developments. CarolinaCon also strives to mix in enough entertainment and side contests/challenges to make for a truly fun event.
Admission to the conference is $20 at the door (no pre-registration). For your $20 you will receive conference admission and a cool CarolinaCon badge. In past years we've also given away magazines, bumper stickers, shot glasses, and free food with the cost of admission. There's no telling what we'll be giving away this year so you'll have to attend to find out.
We will also be selling t-shirts at the conference but a price for those shirts has not been determined yet. You can expect to pay similar prices to what other conferences charge for their shirts (~$20).
| Time | Presentation | Presenter |
|---|---|---|
| 17:00 | N/A | |
| Con registration begins! | ||
| 18:30 | (various) | |
| Shhhhhhh! Listen up! | ||
| 19:00 | Justin Warner (@sixdub) & Will Schroeder (@harmj0y) | |
| Devastating breaches caused by sophisticated attackers have become a significant existential threat to many organizations. Companies must move beyond simple penetration testing to effectively emulate advanced threat actors and provide a realistic picture of how breaches may occur. Increased assessment sophistication calls for the development of new capabilities. PowerShell, with its deep integration to the Windows API and the .Net framework, is the ideal platform for building a new generation of offensive toolsets. In this talk we will cover how our project, Veil’s PowerTools, can provide pen testers and red teamers capabilities to emulate advanced threats. From automating Windows privilege escalation (PowerUp), to advanced situational awareness (PowerView), to the execution of Mimikatz on a huge number of systems for massive lateral spread (PewPewPew), PowerTools can help push down advanced tradecraft to all types of engagements. | ||
| 20:00 | Old Gregg (melvin2001) | |
| Have you ever looked at an rfid card reader and thought "Why cant i just shock the hell out of this thing to open it"? Have you ever wanted to make a pentesting drop box that used low power local wireless to exfiltrate? Don't know shit about circuits or electronics? Come hang out and lets talk about it. I'll likely be bringing some hardware hacking paraphernalia and will make it available in the lockpicking area. Conference attendees are encouraged to bring out their arduinos, raspberry pi's, and etc. We will try to put it all together to create one Super-Hacker-Bot that takes over and creates even more sophisticated progeny, possibly bringing about the end of humankind. | ||
| 21:00 | Joshua Schroeder (JoshInGeneral) | |
| Have you ever wondered how to design a campaign for your organization to see what users click on links or open spam emails? Or if you are on the offense, would you like to gain access to attribution to those spamming your email or other virtual accounts? In this presentation I will demo and release the source code for FeelingPhishy, a PHP tool I created after getting several complaints from people in the industry that existing open source spam campaign solutions were too difficult to setup, had incomplete instructions or didn't work effectively. Some of the features that are included in the tool are: a hashed database of victim data, header modification for time information (allowing some clients to show emails from the past or future), visualization of clicked and viewed emails (realtime), simple port scanning and 20 minute setup time with no need for special libraries and supported by many anonymous free hosting providers. In the second part of my talk I will tell the story about how I learned how to track people using email and fake websites through an email campaign that was undetected for 5 years. The tools built from that campaign (partly released in FeelingPhishy) proved useful when I was approached by a scammer while trying to sell an Xbox One online. It was those techniques and tools that allowed me trick him via text message into revealing his real IP Address and eventually figuring out other profiles and sites that were used by him or his organization to facilitate spamming. | ||
| 22:00 | Old Gregg (digital shokunin) | |
| Sometimes Old Gregg has a whipsy too much of the funk's sweet, sweet funk shakes. Tonight Old Gregg trulled around the Internet to let off some of that excess funk. And found 30 different defacement pages on one website. In this talk, we will cover a brief history of website defacement, some of the more notable defacement in the last few decades, and a snap by snap review of 30+ defacement pages listed on a single website.
OR You've pwned a server, now what? You have to show the world what a l33t h4x0r you are by tagging it with something that shows visitors of your compromised site that you are to be feared and just like the guys in the movies, but you don't want to look like a skiddie (even though you totally are). This talk goes through modern examples of compromise splash pages including the latest in HTML 1.0, animated gifs, profuse use of the blink tag, scrolling text, and background music. We will go through notable examples and critique them. |
| Time | Presentation | Presenter |
|---|---|---|
| 09:00 | N/A | |
| Saturday registration begins! | ||
| 09:45 | (various) | |
| Shhhhhhh! Listen up! | ||
| 10:00 | surpherdave | |
| We continue to use the term "Social Engineer" to make it sexy and make it "h@x0r". the fact that manipulation of people has happened for eternity and it isn't limited to info sec. Lets briefly look at the history books, then delve into the physiology of manipulation. and as I am not a smart man, let's keep it simple with stuff we can use later today to reduce our bar tabs. | ||
| 11:00 | Old Gregg (myddrn) | |
| Sometimes Old Gregg just gets tired of it all. Tired of the shoes. Tired of the baileys. Tired of flashing Old Gregg's glorious mangina and making funk shakes. Even Old Gregg has to retire. This talk will cover the hows and whys of what to do after a cryptocurrency theft occurs, from the thief's point of view. We will go over different strategies for removing trails from "hot" cryptocurrency and combine them into a master plan. This talk will also touch on efforts within cryptocurrency protocols to eliminate the need for laundry services; as removing the lineage of a coin has practical applications well beyond theft. | ||
| 11:30 | Alejandro Caceres (h4liax) & Chris Koepke (haxwithaxe) | |
| MassWeb is extremely fast distributed web application fuzzing framework to scan massive amounts of websites at once. It is the blood and guts of the latest version of PunkSPIDER, an open source web vulnerability scanner and searchable repository of vulnerabilities discovered across the Internet (presented at ShmooCon 2014, DEF CON 22, and more). Massweb is extremely fast web application fuzzing made simple. It sports a Python interface and allows for easy crawling and discovery of new targets, customization of payloads, multithreaded HTTP requests and is friendly to use over a distributed scanning cluster. In 2014, we used MassWeb over a Hadoop cluster to scan a large subset of the Internet's web applications for vulnerabilities over a span of a few very interesting days and found several intriguing results to say the least. The short story is that there's a lot of vulnerable web apps out there and web admins hate being scanned by MassWeb, the long story (including legal threats!) and raw numbers will be presented at this talk. This presentation will serve as both the unveiling of MassWeb as an open source distributed web app fuzzing tool and an analysis of those results. | ||
| 12:00 | N/A | |
| It's certainly 5 somewhere! | ||
| 13:00 | Jason Gillam | |
| Do you have any idea how many of the 2014 data breaches involved client side attacks? In this semi-technical talk Jason will explore beyond the typical JavaScript alert popup box we are all too familiar with in web app penetration tests. He will break down common (and some less common) web client attacks to provide better insight into how to discover them and how to make use of them in more complex attack scenarios. This talk is geared towards those who are somewhat new to web penetration testing but will also benefit non-technical audiences who want a better understanding of web client vulnerability jargon. | ||
| 14:00 | Old Gregg (smrk3r) | |
| Pentesting and social engineering often go hand in hand, but sometimes trying to explain this convergence can be like explaining how to walk down a hallway with your best friend.
This talk will be an off-the-record, names-have-been-changed-to-protect-the-innocent look at examples of successful converged testing. In an attempt to foster creative thinking and an ability to actually AVOID rtfm, we will explore adventures and story-telling for joy, sadness, and learning how to perform (and detect) the most effective offensive security practice that currently exists: full-scope red teaming. |
||
| 15:00 | Unregistered & Snide | |
| Exploring the phone system was once the new and exciting realm of “phone phreaks,” some of the first “hackers.” When personal computers became more pervasive, however, BBS(s) and, eventually, the Internet shifted the focus of the information and telecommunication security community. Voice security, and telephony in general, has become, over time, something of a mystery - something more akin to voodoo or black magic. Dial plans? The stuff of legend and nightmares. In this presentation we will attempt to change that perception. Starting with a journey back in time, we will briefly take a look at telephone system evolution and the attacks early systems faced, with our journey ending at today’s "advanced" VoIP systems. Though systems have become more complex, some of the same basic attacks are still prevalent and exploitable. The transition to VoIP has created opportunities for a variety of new attack vectors as well. Come with us on an expedition through time, space, and telephony, as we explain how voice systems are targeted, how they are attacked, and how to defend them with demonstrations and practical tips along the way. | ||
| 16:00 | @th3mojo | |
| I intend to show how similar hackers are to rednecks. In doing so I hopeto encourage people to be more accepting of rednecks. Hackers and the greater InfoSec community has always been one of acceptance. So to are rednecks. They will invite you over, feed you, and be your best friend. Even though rednecks are getting more attention as of late, it's the wrong kind of attention. Many of the InfoSec folks I know are from small towns in the south. Furthermore, I'm learning that almost every state has a redneck population. There have been sightings in Ohio and Alaska. I believe that there may be a link between rednecks and hackers in that many hackers grew up in small, poor towns with relatives that were intuitive problem solvers. Both groups have to visualize the solution in their minds first and then, once complete, manifest it into reality.Hackers and rednecks possess a strong desire to forge their own way.They both employee creativity to solving problems. And both groups often end up doing things themselves rather than waiting for someone to offer something for sale. And, and if you need further convincing. Hackers and rednecks love to binge drink. Seriously. With lots of other people also binge drinking. If you're still not sold, come see my talk and I'll provide a first-hand account, with pictures, of a man that is a hacker, a redneck, and a genius. | ||
| 17:00 | N/A | |
| Take care of your server! | ||
| 19:00 | Howard Payne & Deviant Ollam | |
| You may have seen Howard and Deviant talk about Elevator Hacking at events like HOPE in NYC or DEFCON in Las Vegas. However, the limited time windows for those talks meant restricting the content to the basics. In the intimate and booze-fueled atmosphere of CarolinaCon, however, it is their pleasure to share with you some of the more obscure sides of the elevator and escalator industry. See photos and hear tales of some of the more bizzare hacks and mods that constructors and elevator techs have used to just get the system working in the past. Most of all, we invite you to ask us all of the odd questions that you may have been pondering all your life as you ride between floors. This would be a fully-featured talk wherein we discuss "hacks" and "tricks" that the industry has implemented at times in order to "just make it work" | ||
| 20:00 | Vic Vandal, AlStrowger?, emwav | |
| Test your brain! | ||
| 21:00 | N/A | |
| Bottoms UP!! |
| Time | Presentation | Presenter |
|---|---|---|
| 09:30 | N/A | |
| LAST day to register! | ||
| 09:45 | (various) | |
| Shhhhhhh! Listen up! | ||
| 10:00 | Lokesh Pidawekar | |
| In this presentation I will cover various infrastructures and platforms that are deliberately vulnerable and can be used to learn hacking ethically. I will be covering the topics on how to setup vulnerable software (WebGoat, DVWA, VulnHub, Metasploitable etc.) and develop a fully functional ethical hacking lab that will work as the practice ground for hackers. This presentation will also cover introduction to various bug bounty platforms such as BugCrowd, HackerOne, SynAck etc. in order to practice the pen-testing on real targets.I will share few of my responsibly disclosed bugs as well. | ||
| 11:00 | Andrew Shumate | |
| Have you ever been involved in an incident response and thought while going through the network that you were living in an episode of Hoarders? Have you ever approached the systems personnel and asked if these tools were theirs only to be met with blank stares and the occasional twitch? During an incident Response engagement, this cyber warrior and many members of the incident response team spent several hours asking about multiple dual use tools known to be used by the threat actor. These tools were located throughout the network, and there was no way for the incident responders to know which tools were there for legitimate purposes and which might have been placed there by the intruder, or if the intruder was simply being opportunistic in using them. To counter this problem, a ‘Tool Control Program’ could be put in place at the enterprise level. This program is simply the centralization, standardization and documentation of tools and utilities used. Though this process any dual use tool that is found on the network can easily be identified as either a legitimate tool used for network operations or as an indicator that an intruder has copied it over for nefarious purposes. | ||
| 11:30 | Mark Rickert, aka Matt Foley | |
| I'm Mark and I live in a van. I travel the country and skydive. I'm also an Internet professional and work from the road. This talk will show you what it's like to live off the grid as a vagabond and still be a productive member of society making money while you travel. Talk topics will include things like: how I get electricity, internet problems, where to sleep, where to work, staying social on the road, etc. and will be littered with lots of fun skydiving photos and videos of me doing stupid things. | ||
| 12:00 | N/A | |
| 13:00 | chill | |
| In this day and age, we are all [mostly] fully aware how far signature-based antivirus detections go... not very far at all in regard to real-time protection. Users will get infected, there are no longer any IF statements in this equation. My focus is the gray area of post-infection and the many different aspects of end-user and incident response frustration that occur after a virus has penetrated a system, or organization, and done its dirty work. I will also be going over various malware removal and mitigation techniques, tools of the trade, and general guidelines to follow to prevent infections from happening in the first place. | ||
| 14:00 | Rob Weiss & John Eberhardt | |
| Network operations are constrained by three fundamental issues: i) shortage of qualified personnel; ii) a complex operational environment, and iii) a sparse pattern recognition problem. Addressing these challenges requires technologies, tools, and methods that revisit how we look at network data and how we allow much broader groups of users to interact with this data intuitively in “cyber time.” Our goal is to allow any user–technical or otherwise – to interact with their network and network data just like they interact with the physical world. To achieve this, we combined streaming analytics and an immersive, intuitive user interface to show continuous real-time network data, allowing broad groups of personnel to do real-time anomaly discovery. Humans can “walk through” a network and its traffic to see “real” patterns in the network. By taking advantage of fundamental strengths in the human brain for sparse pattern recognition, we go beyond analytics and intrusion detection systems, allowing the human to be the final analytics engine.0 This opens the way to gamification of network operations, including concepts such as the crowdsourcing of network defense. Our approach uses four open-source components: i) an ingestion layer that uses a custom built pluggable Python library, ii) a platform that consists of a data streaming layer (Apache Storm) for data processing and application layers that host parallel streaming analytics (Trident-ML), iii) a construct that creates a visual language of networking and supports interfacing between the platform and other services, such as the user interface, and iv) a streaming virtual world that provides users with an immersive, intuitive user experience. We will discuss and demonstrate our project on network service usage patterns in the context of network topology and user roles (e.g., is this user accessing applications and services in a pattern and manner consistent with their role in the organization?) and we will present and demonstrate the following: A conceptual overview of our approach: machine learning, streaming analytics, augmented reality, the idea of crowd sourcing innovative solutions to network defense problems, and why this concept has the potential to radically alter how we look at networks. A review of our system architecture, tools used, methods for developing the system and references to code repositories and resources (so you can build your own!). We will explain how network data flows real time through the streaming analytics (Storm), gets scored by pattern mining algorithms (Trident-ML), flows through the construct and gets rendered in the 3D immersive environment via a visual language. An online demonstration of the platform, showing how users can interact directly with network data and concepts in an immersive environment to identify anomalous behavior. We would also like to make system access available to conference attendees throughout the conference. | ||
| 15:00 | Schuyler Towne | |
| Vivant Denon was a talented pornographer, prolific looter and perhaps the most eloquent European to bear witness to the antiquities of Egypt. His journal also introduced the world to the earliest known lock. It was a rudimentary pin lock, carved into a wall at the Palace of Ma'at. His offhand proclamation that the lock was "4000 years old" has been oft-cited by encyclopedias, lock manufacturers, and even scholars. However, recently there has been strong evidence emerging to place its invention elsewhere, and suggest a more precise, if somewhat broad window in which the first lock entered the world. Relying on the efforts of some amazing archaeologists and linguists, I propose that that the first key-based locks originated in Mesopotamia between 2500 & 1800 BCE. Redefining the origin of the lock does more than settle (or reignite) a debate in a niche community. The Mesopotamian theory provides a window into the nature of security's role in society. By following the lock back to its more primitive technological ancestors, we can begin to build a theory for not just how, but why this ubiquitous object came into existence in every society the world has known. | ||
| 16:00 | (various) | |
| The end is nigh! | ||
| 16:30 | N/A | |
| Namaste, or no more stay... get the hell out! |
Side events? As in more than just talks! You betcha! As events are decided and plans made, they'll be posted. Stay tuned!
Android: Netrunner is a two player Living Card Game set in a dystopian, cyberpunk future when monolithic mega corps own and control the vast majority of human interests. While corporation players try to score points by advancing their agenda, they have to guard their intellectual properties from elite and subversive hackers known as net runners. Click HERE to learn more about this game.
If you would like to learn how to play Android: Netrunner, we will have a few tables setup and will be providing the core net runner cards to show you have to play the Android: Netrunner. There also is a great tutorial on YouTube that goes over the basic rules. If you have already played Android: Netrunner then bring your decks to the side event. We are in the process of getting a 2015 tournament kit and putting on a small tournament. It’s not official as of yet, but if all the paper work gets approved we should be able to have a small tournament. Sign up will be first come; first served.Now in its 6th year, the Annual, Unofficial CarolinaCon Shootout is once again a go! Click HERE to visit the official page and get all the details!
"CTF, is a traditional outdoor game where two teams each have a flag (or other marker) and the object is to..."
We kid; we do, we do! Seriously, as a staple CTF needs no introduction. But for any newer folks out there: CTF (note the apparent requisite white t-shirts and glasses)
Presenting FALE (FALE Assocation of Locksport Enthusiasts) village of lockpicking. Impress all your friends (and family members) by locking yourself out of your house and picking your way in!
Sometimes, you need to reminisce (old folks) or know your roots (young folks). Enter, the Vintage Tech Museum, Apple IIe, Vic20 (not Vic when he was 20!), Commodore 64, TRS80 Model 1, Tandy Color Computer 1 & 2, and more!
BYOB (you are encouraged people to purchase from the hotel). Drink anytime someone (in the movie) drops the F*Bomb or GD. If anyone is left standing at the end of the movie....they deserve something that has yet to be determined but totally cool, for drunk people.
CarolinaCon 11 will be held at 35.830122, -78.620365
Hilton north Raleigh/Midtown
3415 Wake Forest Road
Raleigh, NC 27609
Last Day to Book: 20-FEB-2015 - BOOK NOW!
Special Room Rates: rates are quoted for single occupancy
1 QUEEN BED W/SOFA SLEEPER rates from $105.00 USD/Night
1 KING BED rates from $105.00 USD/Night
2 DOUBLE BEDS rates from $105.00 USD/Night
CarolinaCon was started in 2005 and has been held every year since. With each passing year the conference continues to grow and attract more attendees and speakers. As has always been the case, CarolinaCon is put together and run by an all-volunteer staff. CarolinaCon is proudly brought to you by "The CarolinaCon Group". The CarolinaCon Group is a non-profit organization registered in the state of NC, dedicated to educating the local and global communities about technology, information/network/computer security, and information rights.
The CarolinaCon Group is also closely associated with various 2600 chapters across NC, SC, TN, VA, LA, DC, GA, PA and NY. Many of the volunteers who help develop and deliver CarolinaCon come from those chapters.
Who develops and delivers CarolinaCon?
CarolinaCon is proudly brought to you by "The CarolinaCon Group". The CarolinaCon Group is a non-profit organization registered in the state of NC, dedicated to educating the local and global communities about technology, information/network/computer security, and information rights. The CarolinaCon Group is also closely associated with various "2600" chapters across NC, SC, TN, VA, LA, DC, and NY. Many of the volunteers who help develop and deliver CarolinaCon come from those chapters.
What events will be at CarolinaCon?
CarolinaCon is mainly about the educational talks, presentations, and demos. Alongside those we will have several other technology-related contests and challenges. Details on other events will be announced on our website as they are planned out.
Can my company sponsor CarolinaCon?
We don't accept any, so don't bother asking. Capitalism and philanthropic knowledge-sharing don't mix in our opinion. We keep our admission price to the bare minimum to cover our venue and equipment expenses. All of our staff are volunteers who generously donate their time and energy. All of our presenters generously donate their time and talent. The only items sold at CarolinaCon are a limited quantity of single-design CarolinaCon t-shirts....and we only make and sell those because attendees and staff want them.
What about donating to CarolinaCon?
Well that's a different story. We will gladly accept donations from anyone who wants to contribute. At CarolinaCon, we pride ourselves on not charging a lot for admission so we don't have a lot to spend on giveaways (we manage though). We can always use prizes for Hacker Trivia and various other contests that we run so if you want to donate an actual prize, rather than cash, just let us know by sending an email to:
_ __ ____ _ _
(_) _ __ / _| ___ / __ \ ___ __ _ _ __ ___ | |(_) _ __ __ _ ___ ___ _ __ ___ _ __ __ _
| || '_ \ | |_ / _ \ / / _` | / __| / _` || '__| / _ \ | || || '_ \ / _` | / __| / _ \ | '_ \ / _ \ | '__| / _` |
| || | | || _|| (_) || | (_| || (__ | (_| || | | (_) || || || | | || (_| || (__ | (_) || | | | _ | (_) || | | (_| |
|_||_| |_||_| \___/ \ \__,_| \___| \__,_||_| \___/ |_||_||_| |_| \__,_| \___| \___/ |_| |_|(_) \___/ |_| \__, |
\____/ |___/
We'll also take cash. :-)