An Artificial Intelligence (AI) extremely surpassed the human intelligence is called "Superintelligence". In a short while, the Superintelligence will be developed for the first time in our history. The Superintelligence raises an exponential development of the scientific technology and affects the human society and civilization. The time is called "Singularity (Technological Singularity)". An American futurist Ray Kurzweil, who bruits the concept of Singularity, predicts that the time will come in the year 2045. And he also predicts that the capacity of the AI will gets up to that of a human in the year 2029. I would like to call the period prior to 2045 as "Pre-Singularity". An AI used for a specific purpose is called "Narrow AI", and an AI used for general purposes is called "Artificial General Intelligence (AGI)“. Today there is only Narrow AI, but it will greatly affect the human society such as Technological Unemployment in the coming future. If AGI comes into being, the influence increases dramatically. Researchers all over the world endeavors to develop the AGI. In recent years, researches of the Superintelligence are implemented in Japan. I will discuss what is the Superintelligence and political, economic, technological and military significances. I will especially introduce the roadmap for the development of the Superintelligence in Japan. I will also discuss about the possibility that Singularity will be occurred from Japan in 2020s much earlier than the year 2045.

Over a decade ago, a friend at the National Security Agency told Richard Thieme that he could address the core issues they discussed in a context of "ethical considerations for intelligence and security professionals" only if he wrote fiction. "It's the only way you can tell the truth," he said.

Three dozen published short stories and one novel-in-progress (FOAM) later, one result is "Mind Games," published in 2010 by Duncan Long Publishing, a collection of stories that illuminates “non-consensual realities:” the world of hackers; the worlds of intelligence professionals; encounters with other intelligent life forms; and deeper states of consciousness.

A recent scholarly study of “The Covert Sphere” by Timothy Melley documents the way the growth and influence of the intelligence community since World War 2 has created precisely the reality to which that NSA veteran pointed. The source of much of what “outsiders” believe is communicated through novels, movies, and television programs. But even IC “insiders” rely on those sources, as compartmentalization prevents the big picture from coming together because few inside have a “need to know.”

Thieme asked a historian at the NSA what historical events they could discuss with a reasonable expectation that their words denoted the same details. “Anything up to 1945,” the historian said with a laugh – but he wasn’t kidding.

Point taken.

This fascinating presentation illuminates the mobius strip on which all of us walk as we make our way through the labyrinth of security and intelligence worlds we inhabit of necessity, all of us some of the time and some of us all of the time. It discloses why “post-modernism” is not an affectation but a necessary condition of modern life. It addresses the response of an intelligence analyst at NSA who responded to one of Thieme's stories by saying, “most of this isn’t fiction, but you have to know which part to have the key to the code.” This talk does not provide that key, but it does provide the key to the key and throws into relief everything else you hear – whether from the platform or in the hallways – inside this conference. And out there in the “real world.”

“Nothing is what it seems.”

The encryption method of Microsoft Office 2010 and thereafter is designed to be considerably safer than that of the versions prior to MS Office 2007. However, it is revealed that encrypted files of Excel 2010 and 2013 which are created under a specific condition can be decrypted easily, no matter how strong the configured password is. In this session, we will show the background behind the discovery of the backdoor and a demonstration of the decryption tool for the vulnerable encryption. And we will also introduce the tool that modifies the encryption of files containing such vulnerability for a stronger encryption.

We are in the IoT era. In this session, the function of GNURadio will be introduced with demonstration. GNURadio is a SDR (Software Defined Radio) tool to analyze wireless security such as Bluetooth LE. As an example of a SDR usage, I will demonstrate the replay attack for RF signal of ADS-B (Automatic Dependent Surveillance Broadcast) mounted on an aircraft and sniffer for wireless keyboards. Ideas of the counter measurement will also be discussed.

Some voices claim that "Angular is what HTML would have been if it had been designed for building web applications". While this statement may or may not be true, is certainly accounts as one of the bolder ones a JavaScript web framework can ever issue. And where boldness is glistening like a German Bratwurst sausage in the evening sun, a critical review from a grumpy old security person shouldn’t be too far away. This talk will have a stern, very stern look at AngularJS in particular and shed light on the security aspects of this ever-popular tool. Did the super-hero framework do everything right and follow its own super-heroic principles? Does AngularJS increase or rather decrease the attack surface of a web application? How does AngularJS play along with the Content Security Policy, and was it a good idea to combine this kind of security with futuristic feature creep? And what about AngularJS version 2.0? Beware that we won’t stop at glancing at the code itself, investigating security best practices, and verifying compatibility and other common things that contribute to robust security (or lack thereof). We will cross the moral border and see if the AngularJS team could notice rogue bug tickets. A pivotal question that everyone is wondering about is: Have they successfully kept evil minds like yours truly speaker here from introducing new security bugs into the code base? This talk is a reckoning with a modern JavaScript framework that promises a lot and keeps even more, not necessarily for the best for developers and users. We will conclude in deriving a general lesson learnt and hopefully agree that progress doesn't invariably mean an enhancement.

The number of corporations establishing bug bounty programs in order to accomplish early discovery of vulnerabilities is increasing. So far, I have reported vulnerabilities in Firefox and received 45,000 USD (5,400,000 JPY) in bounties from the developer, which is the Mozilla Foundation. As a matter of fact, the vulnerabilities discovered in Firefox have a trend however, the awareness of the trend has not being raised among the Firefox developers and every time a new feature is implemented, a similar vulnerability is repeatedly created in the code. In this session, based on the vulnerabilities I have discovered in the past, I will introduce the patterns of vulnerabilities frequently observed in Firefox and delineate the root cause of those vulnerabilities. In addition, I will introduce my practical method that will allow you to effectively discover bugs in Firefox. This method is actually applicable not only to Firefox but any other open source software as it is based on an issue particular to open source software.

This talk is about the introduction of Wooyun.
WooYun is a platform where security researchers report vulnerabilities and vendors give feedbacks. While WooYun follows vulnerabilities, it also provides researchers a platform for public interests, study, communication, and research.I will introduce how WooYun works and why we start this project in my presentation, also what WooYun changes in the security circle in China, and why, when, where it built, how it developed and the difficulties when developing.

The Bazaar, the Maharaja's Ultimatum, and the Shadow of the Future: Extortion and Cooperation in the Zero-day Market

Zero-day vulnerabilities are gaining a prominent role in the modern-day intelligence, national security, and law enforcement operations. At the same time, trading vulnerability information or zero-day exploits is considered a risky ordeal. Players in the secretive zero-day market face some inherent obstacles related to time-sensitiveness of traded commodities, trust, price fairness, and possibility of defection.

To alleviate some of these hurdles, it was suggested to: 1. Use punishment (i.e., public disclosure of vulnerabilities) to discourage a buyer from defecting; 2. Resort to the use of trusted-third parties (e.g., escrow services), as crucial entities for enabling cooperation of market participants; and 3. Build a reputation system (e.g., reputation score) as an instrument to establish trust relationships between distrustful players.

Building upon the empirical observations contributed by the first three public case studies, this work presents the first results of an ongoing research on extortion and cooperation in zero-day markets through the lens of game theory.

The questions motivating this research are: a. Can the zero-day market achieve cooperation and efficiency even in absence of trusted-third parties? b. Can punishment discourage the buyer from defecting? c. Under which conditions a player can extort the opponent? d. Can cooperation be sustained also in fully anonymous or semi-anonymous settings? The talk will address these questions and others, by providing an analysis of the zero-day trading strategies applicable to each scenario.

Learn which strategies allows to maximize the profits while trading zero-days in today's marketplaces. Find out how to avoid getting extorted by zero--day traders. Learn how to extort an unwit market participant. Gain a deeper knowledge about the emergence, sustainability, and breakdown of cooperation. Discover under which conditions the zero-day markets can achieve efficiency.

This work find application in a number of markets for vulnerability information and zero-day exploits. They range from over-the-counter zero-day trading, to boutique exploit providers offering zero-day vulnerabilities for a subscription fee, to service models for vulnerability research.

Machine learning-based (ML) techniques for network intrusion detection have gained notable traction in the web security industry over the past decade. Some Intrusion Detection Systems (IDS) successfully used these techniques to detect and deflect network intrusions before they could cause significant harm to network services. Simply put, IDS systems construct a signature model of how normal traffic looks, using data retrieved from web access logs as input. Then, an online processing system is put in place to maintain a model of how expected network traffic looks like, and/or how malicious traffic looks like. When traffic that is deviant from the expected model exceeds the defined threshold, the IDS flags it as malicious. The theory behind it was that the more data the system sees, the more accurate the model would become. This provides a flexible system for traffic analysis, seemingly perfect for the constantly evolving and growing web traffic patterns.

However, this fairytale did not last for long. It was soon found that the attackers had been avoiding detection by ‘poisoning’ the classifier models used by these PCA systems. The adversaries slowly train the detection model by sending large volumes of seemingly benign web traffic to make the classification model more tolerant to outliers and actual malicious attempts. They succeeded.

In this talk, we will do a live demo of this 'model-poisoning' attack and analyze methods that have been proposed to decrease the susceptibility of ML-based network anomaly detection systems from being manipulated by attackers. Instead of diving into the ML theory behind this, we will emphasize on examples of these systems working in the real world, the attacks that render them impotent, and how it affects developers looking to protect themselves from network intrusion. Most importantly, we will look towards the future of ML-based network intrusion detection.

Malware threats are becoming reality also on the iOS devices.
Apple's app review and the iOS sandbox have been protecting users from malware.
However it has become necessary to take measures because new methods of malware infection techniques have emerged recently.

The WireLurker infects to iOS app by exploiting USB Sync.
iOS Developer Enterprise Program had abused by One-Click fraud app.
These are new techniques which appeared in the past year.
Third-party framework is now available as "Embedded framework" for app development from the iOS 8.
A Research which realizes SSL Pinning using the Embedded framework has been published recently.

The iOS have been fixed a lot of security problems.
However, the attackers always are trying to bypass security.
I am concerned that the attacks to iOS will be soon earnest.
Apple still seems to believe that additional third-party security software is unnecessary.
Therefore security vendors cannot supply advanced security software for iOS.
iOS users have no choice but to depend on Apple.

I have researched iOS malware which may occur in the future.
For example, MITA malware has not been a concern currently.
That is possible by Embedded framework and Method Swizzling.
I show demonstration MITB malware which infects to iOS from PC.
Also I explain method to detect it.

I developed a prototype gadget which detects iOS malware via USB connection.
This gadget is working under the same conditions as malware.
Therefore, it is not restricted by sandbox unlike normal app.
My gadget detects malware by analysis based on attributes of iOS app signature, profile, permission, and third party framework.
It works on the Raspberry Pi and Linux.
If it integrated into battery charger, it can detect malware along with charging.
I will demonstrate of malware detection by my gadget.

Japan is recently experiencing a rise in targeted attacks. However, it is rare that details of such attacks are revealed. Under this circumstance, JPCERT/CC has been investigating the attack operations targeting Japanese organizations including the government and leading enterprises. We have especially been tracking two distinct cases over a prolonged period.
The first case, which became public in 2015, drew nationwide attention for victimizing several Japanese organizations. In this case, the attacker conducts sophisticated attacks through network intrusion and targeting weak points of the organizations.
The second case has been continuously targeting certain Japanese organizations since 2013. Although this case has not drawn as much attention, the attacker has advanced techniques and uses various interesting attack methods.
This presentation will introduce the above two attack operations, including attack techniques we revealed through prolonged investigation, the malware/tools being used, as well as useful techniques/tools for analyzing related malware.

Adobe Reader’s JavaScript APIs offer a rich set of functionality for document authors. These APIs allow for processing forms, controlling multimedia events, and communicating with databases, all of which provide end-users the ability to create complex documents. This complexity provides a perfect avenue for attackers to take advantage of weaknesses that exist in Reader’s JavaScript APIs.
In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption.

Knowledge and identification of Malware binaries is a crucial part of detection and incident response. There was a time when using MD5s was sufficient to ID binaries. The reverse engineering analysis conducted once would be useful anytime that same MD5 hash was seen again. This has rapidly changed in recent years. Polymorphic samples of the same specimen change the file hash (MD5, SHAx etc) without much effort by the attacker. Also, cyber criminals and advanced adversaries reuse their codebase to create newer versions of their malware, but changes in the file hash disallow any opportunity to connect and leverage previous analyses of similar samples by defenders. This gives them an asymmetric advantage.

In recent years, there has been research into “similarity metrics”― methods that can identify whether, or to what degree, two malware binaries are similar to each other. Imphash, ssdeep and sdhash are examples of such techniques. In this talk, Bhavna will review which of these techniques is more suitable for evaluating similarities in code for APT related samples. This presentation will take a data analytics approach. We will look at binary samples from APT events from Jan- Mar 2015 and create clusters of similar binaries based on each of the three similarity metrics under consideration. We will then evaluate the accuracy of the clusters and examine their implications on the effectiveness of each technique in identifying provenance of an APT related binary. This can aid Incident responders in connecting otherwise disparate infections in their environment to a single threat group and apply past analyses of the abilities and motivations of that adversary to conduct more effective response.

Cybozu Labs, Inc. provides a bug bounty program, where the company pays money as a reward for reporting vulnerabilities in their products and services.
Since these products and services are web applications, many security engineers took web-based approaches to find vulnerabilities.
Meanwhile, noticing some of the products are CGI executables programmed using C and C++, I was able to win the highest amount of bounties in 2014 through a binary analysis approach.
In this talk, I will present the vulnerabilities that I have found and the methods used in order to find them.

Electrical Grid is one of the sophisticated systems humanity ever built. New technologies such as IEC 61850 and Europe-wide initiatives to create continent-wide SmartGrid systems makes it more and more complex.

Our latest research was devoted to the analysis of the threat landscape, architecture and implementation of the modern Smart Grid elements, including relay protection, wind and solar energy generation.

It may seem (not) surprising but the systems which manage huge turbine towers and household PhotoVoltaic plants are not only connected to the internet but also prone to many well known vulnerabilities and low-hanging 0-days. Even if these systems cannot be found via Shodan, fancy cloud technologies leave no chances for security.

In this talk, we summarize our practical experience in security assessment of different components of European SmartGrid technologies: from housekeeping and rooftop PV systems to digital substations. We will release new (but responsibly disclosed) vulnerabilities in SmartGrid components, Cloud SCADA technologies as well as new tools for security assessment of SmartGrid industrial protocols.

A few months ago I publicly disclosed an Apple EFI firmware zero day. It was a very powerful bug allowing direct access to the EFI firmware from the operating system. EFI rootkits are some of the most powerful and most interesting rootkits. Because they work at a very low level they can play a lot of tricks to hide themselves from forensics and persist for a long time. EFI monsters are a bit like jaguars, stealthy and rarely seen by humans. This doesn't mean they do not exist. EFI monsters are most certainly part of spy agencies rootkits catalog. Very few tools exist to chase them.

This talk is about introducing you to the EFI world so you can also start to chase these monsters. EFI world might look scary but it's a bit easier than you think and a lot of fun.

Thunderstrike 2 (to be presented at BlackHat) is a fine example of the power of EFI rootkits and the problems they present.

The number of high tech medical equipment is increasing in hospitals. We also see a big market for home monitoring. The security of these devices will play a big role in the future. Our research shows that medical devices taking care of critical tasks like anesthesia devices lack basic security mechanisms. This talk has mainly two parts. In one part we discuss the general problem that we are facing with the security of medical devices. The other part will show proof-of-concepts for different attacks and scenarios to even kill a patient in an undetectable way.

In the first part we will provide information about the general problem that we are facing when dealing with security in the field of medical devices. We will show further research already done by other parties. The number of features increase and vendors start to implement network connectivity. We will show that vendors try to shift responsibility for the security of the devices to the hospitals and discuss why hospitals are not the ones who should be responsible for this issue. This part will have a section where we show how medical devices have evolved and what features we will have to use in the near future. In addition we will provide how hackers can get their hands dirty if they want to step into the same research we did.

Microsoft's web browsers, Internet Explorer and Edge, have a feature called 'XSS filter' built in which protects users from XSS attacks. In order to deny XSS attacks, XSS filter looks into the request for a string resembling an XSS attack, compares it with the page and finds the appearance of it, and rewrites parts of the string if it appears in the page. This rewriting process of the string - is this done safely? The answer is no. This time, I have found a way to exploit XSS filter not to protect a web page, but to create an XSS vulnerability on a web page that is completely sane and free of XSS vulnerability. In this talk, I will describe technical details about possibilities of XSS attacks exploiting XSS filter and propose what website administrators should do to face this XSS filter nightmare.

Windows 10 IoT was released as a platform for IoT.
Windows 10 IoT Core, which is the lightest among Windows 10 IoT, is usable without charge, and can be run on single board computers like Raspberry Pi. So far, Linux-based platforms were considered as the platform for IoT devices, but now there is another option.
We conducted research on security system of Windows 10 IoT Core to judge whether it could be used safely.
We investigated the security design, the security functions, and default services, such as Web, FTP, and SSH, served by this OS. Furthermore, we also analyzed risks of intrusion and malware infection.
As a result of the investigation, like the newest Windows, we found that DEP, ASLR and CFG are also effective as countermeasures for being attacked vulnerabilities that affect the main memory. These countermeasures are not omitted from Windows 10 IoT Core.
On the other hand, we also found some designs and default settings of services and components are insecure.
For example, Windows update is disabled, Windows Firewall is disabled by default settings, Web interface is served on HTTP, and its authentication is basic authentication.
Moreover, we found a problem in the design of the remote debug service. This problem allows an attacker to create any user account and intrude using the web interface or SSH. Therefore, this problem might be abused by worm malware.
Lastly, we will introduce recommended security measures such as disabling unused services, changing settings, enabling the firewall, enabling web interface on HTTPS, etc.

In Korea, cyber warfare has become real, not a virtual one. North Korea continues to expand its cyber warfare capabilities.
South Korean National Intelligence Service (NIS, Korean CIA) officially reported 75,472 cyberattacks launched against the government and public agencies from 2010 until October 2014. Additionally, the NIS's National Cyber Security Center reported that North Korea attempts millions of indiscriminate cyber-attack attempts on government agencies and private corporations in South Korea.
The NIS believes that North Korean General Bureau of Reconnaissance, specifically Unit 121, dedicates more than 6,000 full-time hackers who create malicious computer codes. This estimate, which was echoed by the South Korean Ministry of Defense in a white paper released in January 2015, is double the estimated figure previously released by the NIS in 2013. According to claims by North Korean defectors, the North Korean government began to focus on its cyber capabilities as an attempt to develop its asymmetric warfare in the 1990s, when economic hardships put strains on its conventional military assets. At that time, Mirim University - since renamed Pyongyang Automation University - was opened to train hackers in electronic warfare tactics.
To narrow the gap with the North, recently South Korean government has been devoting itself to raise more cyber security experts. In this talk I will talk how our government invests in human capital for cyber-security. Especially, I will focus on the training programs of , , and , all of which play the central role for bring up security experts. Aside from state-run programs, I will give a talk about private sector’s effort to train white-hat hackers (for example, SECUINSIDE of , CODEGATE of , POC of , , , etc).
Given that a variety of training programs are underway to secure more security and hacking experts, we seems to be making progress. For example, , the team comprised of students from Korea University and the Korea-based IT security solution provider RAONSECURE, won the TOP prize at the ‘DEFCON CTF 23’! However, we have problems that still needs to be solved. I will also point out these.

Malware utilize many cryptographic algorithms.
To fight against malware, analysts have to reveal details on malware activities.
Accordingly, it is important to identify cryptographic algorithms used in malware.
In this track, I propose a faster and extensible method to automatically detect known cryptographic algorithms in malware using dynamic binary instrumentation and fuzzy hashing.

Stack Smashing Protection(SSP) is one of the oldest and fundamental protections against exploits, and is now supported by most compilers and modern operating systems.
One technique for SSP is using stack canaries, which verify if a stack buffer has been overflown by checking the integrity of a value stored immediately after the buffer.
Previously, the main methods to bypass stack canaries were to exploit different vulnerabilities to either avoid the canary validation completely, or to provide the correct canary value by leaking the value.
In this talk I will propose a new technique to bypass stack canaries in SSP which takes a different approach from the previous two methods.

Cyber espionage attacks have been aware of for around 10 years. Security vendors keep inventing new technology to defend against attack. Many solutions look fancy, however breaches keep happening. People spent a lot of budget to improve their fences, but the effectiveness of these security products remains doubtful. In Taiwan, we have more than 10 years history with cyber espionage attacks. Government, enterprises, and security vendors were fighting hard with threat actors, but new victims still got compromised day by day.
In recent years, a lot of Japanese government agencies, defense industry, enterprises are suffering from cyber attacks from cyber espionage groups. We keep seeing breaches and incidents from news. We believe many victims still have no good strategy to defend and control the situation.
In this talk, cyber espionage attacks in the last decade would be discussed from Asia Pacific region’s point of view. We’ll discuss why security solutions didn’t work, how actors easily bypassed those fancy solutions and adopted countermeasures quickly with very low cost. Besides, according to our incident response’s experience for hundreds times and consulting to help victim for several years, we will try to propose a design of security model to prevent, detect, react, and remediate cyber espionage threats.

The modern web-scale network is a pretty complicated place. Modern techniques in Systems Management have made it trivial to create, destroy and repurpose any number of instance types. These instances can span the range from bare metal machines sitting in a datacenter, to 3rd party virtual machines on demand, and now these new containers and microservices seem to be all the rage. Instances are cattle, they are no longer pets. All of this perpetual churn and flexibility is exactly what you want in a constantly changing, highly available, and efficient infrastructure. The ability to create or destroy nodes on demand, or continuously and automatically scale up, down, and re-deploy applications as part of a continuous integration pipeline, have become necessary and an integral part of daily operations. However these systems can generate terabytes of network logs a day. And if your job is detecting, correlating, and alerting on the correct anomaly in all that data, the analogy of the needle in the haystack really doesn’t do it justice, something closer would be akin to finding a needle in the windstorm. How do you begin to collect, store, analyze, and alert on this much data without costing the company a small fortune? What are some practical steps you can take to reduce your overall risk and begin to gain more insight, visibility, and confidence into what is actually taking place on your network? This talk aims to give the attendee a solid understanding of the problem space, as well as recommendations and practical advice from someone who built their own ‘big data’ network and security monitor. It really is easier than it sounds.