To achieve their espionage goals, threat actors need a mechanism to exfiltrate data from their targets. Malware developers have a multitude of choices to achieve this task, for example, the design and implementation of a custom communication protocol, and the use of an existing protocol offered by cloud services.

This presentation will discuss the benefits and limitations of implementing a custom communication protocol, and the cases where attackers abused third-party cloud services in selected targeted. These cases involve targeted threat actors across the globe, including Patchwork (South Asia), DRBControl(South East Asia), Confucius (South Asia), MuddyWater (Middle East), and SLUB (Korea)

Insider threat is a malicious threat that comes from people within the organization, such as employees, former employees, contractors or business associates.

In this session, Joseph will discuss the real-life concern of many organizations that rarely hits the news: the motive, detection, interdiction, tactics and strategy of insider threats, which are among the most devastating threats that any organization will ever encounter.

Open source software has become the standard foundation upon which most IoT devices are built these days. It helps to keep costs down and allows for easy customization in order to suit specific needs. However, there are some very common problems and potentially serious security ramifications that come along with those benefits.

In this presentation, Ricky will discuss some of the more common pitfalls that users and developers need to be mindful of when using and modifying open source software. He will go over some real-world examples of vulnerabilities and exploits in IoT devices, how they were found, and how to avoid making the same mistakes in the future by following certain best practices.

In this session, Dusan will provide an overview of the insecure object deserialization in Java and .NET and provide an in-depth look at 2 different cases of these vulnerabilities. In the first part of the presentation, Dusan will delve into the basics of object serialization and provide insight into why deserialization attack surfaces exist is applications built on top of Java and .NET.

In the second part of the presentation, Dusan will present an overview of two specific recent cases of deserialization vulnerabilities in Java and .NET, where he will provide an indepth look at the vulnerability in the 3 scenarios and how to detect these forms of attacks.

Reverse engineering routers and IoT devices may seem daunting for beginners. In this session, Vincent will guide you through hardware reverse engineering and vulnerability hunting processes through vulnerabilities affecting two routers. He will explore the hardware architecture and design of the TP-Link TLWR841N and the Belkin F7D2301 router.

In addition, he will look at the Linux-based firmware of the TP-Link and the RTOS-based firmware of the Belkin, then walk through the vulnerabilities reported in these routers.

Law enforcement (LE) agencies play a vital role in shaping down cybercrime trends. As a seconded researcher to an LE agency, Paul will be sharing some of his experiences on working with them.

This presentation will discuss how Trend Micro's provision of expert insights and datasets help LE agencies proceed in some investigations. The presentation will also highlight the dependencies of LE to private partners (cybersecurity firms) and vice versa by citing some cases. In addition, Paul will share some tips and tricks on how to utilize threat intelligence in order to move forward.

The Philippine National Police Anti-Cybercrime Group (PNPACG) aims to implement and enforce pertinent laws on cybercrime and other cyber-related crimes and pursue an effective anti-cybercrime campaign.

In this session, PCol. Zuñiga will be detailing how the PNP-ACG works in creating a safer cyber environment to enforce its mission. He will be providing an overview of its operations and its significant accomplishments over the years. He will be sharing about the unit's functions, for example, how they investigate cybercrimes and formulate guidelines. He will also be talking about facts and figures concerning the cyberspace and cybercrime trends.

Facial recognition access control is one of the killer apps that benefit from the emerging edge computing architecture, which brings the processing power near the endpoints for faster processing speed, less latency and reduced demand of bandwidth.

This presentation will discuss three popular facial recognition systems and the vulnerabilities that have identified, including: server command forgery, user arbitrary addition, privilege escalation, man-in-the-middle, and face database exposure. the presentation will also demonstrate how to leak employee pictures, automatically add unauthorized personnel as administrator, and impersonate a back-end server in order to open the doors and leave a false trace to deceive auditions.

Facial recognition access control is one of the killer apps that benefit from the emerging edge computing architecture, which brings the processing power near the endpoints for faster processing speed, less latency and reduced demand of bandwidth.

This presentation will discuss three popular facial recognition systems and the vulnerabilities that have identified, including: server command forgery, user arbitrary addition, privilege escalation, man-in-the-middle, and face database exposure. the presentation will also demonstrate how to leak employee pictures, automatically add unauthorized personnel as administrator, and impersonate a back-end server in order to open the doors and leave a false trace to deceive auditions.

As more industries adapt to cater to the increasingly mobile market, the financial industry is the latest to experience a shake-up. The Revised Payment Service Directive (PSD2) - also known as Open Banking - is a new set of rules for the European Union (EU) that's expected to affect the global financial industry.

With Open Banking, banks will have to provide APIs to share customers' banking data with third parties. Hear the results of our research into the challenges of protecting the larger attack surface created by open banking and the potential security issues associated with APIs, banking apps, and protocols

User-After-Free (UAF) vulnerabilities have been widely used in developing web browser malware variants. A UAF vulnerability concerns the incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, malicious actors can use the error to hack the program.

In this presentation, Andy will introduce the technologies and tricks available to write a real shellcode exploit abusing a UAF vulnerability.

Criminal infrastructure is an important chain that binds the whole underground ecosystem. This presentation will focus on the evolution of technologies and approaches which underground actors use to maintain and protect their infrastructures. It will show how actors abuse legitimate hosting and cloud services, exploit geographical and cross-jurisdictional issues to avoid takedowns, or even maintain server farms located in private houses in rural areas.

The presentation will also discuss the shifts on underground hosting approaches, which are enforced by the introduction of new technologies. The presentation contains several case studies that are based on our investigations of cyber incidents.