#ndcsecurity — Public Fediverse posts

I find it really funny that shortly after @SheHacksPurple shared a funny story about using people using Base64 as "encryption" during #NDCSecurity few days ago my colleague shared this screenshot with me.
#Base64Encryption

I find it really funny that shortly after @SheHacksPurple shared a funny story about using people using Base64 as "encryption" during #NDCSecurity few days ago my colleague shared this screenshot with me.
#Base64Encryption

Until next time Europe! Thank you so much for having me! 😘

#ndcsecurity NDC Conferences #norway #london #uk

Until next time Europe! Thank you so much for having me! 😘

#ndcsecurity NDC Conferences #norway #london #uk

And now @PhilippeDeRyck breaking #oauth #NDCSecurity

And now @PhilippeDeRyck breaking #oauth #NDCSecurity

Kicking off the morning session at #NDCSecurity with Scott Helme talking cryptojacking.

Kicking off the morning session at #NDCSecurity with Scott Helme talking cryptojacking.

Also watched a very good talk from @ladynerd at #NDCSecurity today on actually using the data in your GitHub org to find security risks. https://safestack.io looks interesting too.

Also watched a very good talk from @ladynerd at #NDCSecurity today on actually using the data in your GitHub org to find security risks. https://safestack.io looks interesting too.

Come see @lady_nerd speak at @ndc_conferences in Room 2! Right now! 🎉

#ndcsecurity

Come see @lady_nerd speak at @ndc_conferences in Room 2! Right now! 🎉

#ndcsecurity

Excellent talk from Kim Wuyts at #NDCSecurity about privacy engineering.

Excellent talk from Kim Wuyts at #NDCSecurity about privacy engineering.

Come learn human hacking with Karyna Kholodar at NDC Conferences !

#ndcsecurity

Come learn human hacking with Karyna Kholodar at NDC Conferences !

#ndcsecurity

Come see Brennan Lodge "RAG Against the Machine" at NDC Conferences !

#ndcsecurity

Come see Brennan Lodge "RAG Against the Machine" at NDC Conferences !

#ndcsecurity

On my way to #NDCSecurity Oslo. Should be fun!

On my way to #NDCSecurity Oslo. Should be fun!

My talk on implicit and mutation-based #serialization attacks at #NDCSecurity is now up on YouTube: https://www.youtube.com/watch?v=cD3FiTQ5Lhk

The part on #BinaryFormatter mutation, which I'd never discussed before, starts here: https://www.youtube.com/watch?v=cD3FiTQ5Lhk&t=1694s

I plan to post some additional resources associated with that talk in the near future, including some sample code.

My talk on implicit and mutation-based #serialization attacks at #NDCSecurity is now up on YouTube: https://www.youtube.com/watch?v=cD3FiTQ5Lhk

The part on #BinaryFormatter mutation, which I'd never discussed before, starts here: https://www.youtube.com/watch?v=cD3FiTQ5Lhk&t=1694s

I plan to post some additional resources associated with that talk in the near future, including some sample code.

I interviewed Scott Helme (!!!) at #NDCsecurity, in Norway, Oslo! We talked about getting deep into Encryption. @ndc_conferences @Scott_Helme
Https://youtu.be/MqbnNToYGzs

I interviewed Scott Helme (!!!) at #NDCsecurity, in Norway, Oslo! We talked about getting deep into Encryption. @ndc_conferences @Scott_Helme
Https://youtu.be/MqbnNToYGzs

Just finished my talk at #NDCSecurity .

It was really rewarding. The audience definitely seemed interested, and there were a lot of good questions afterwards. 🙂​

Here's a special string. I'll explain what it's for during my talk later today at #NDCSecurity :

DAwAAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQULAAAAhAFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Tb3J0ZWRTZXRgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAABUNvdW50CENvbXBhcmVyB1ZlcnNpb24FSXRlbXMAAwAGCI0BU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuQ29tcGFyaXNvbkNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCAwAAAACAAAACQ0AAAACAAAACQ4AAAAEDQAAAI0BU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuQ29tcGFyaXNvbkNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAQAAAAtfY29tcGFyaXNvbgMiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgkPAAAAEQ4AAAACAAAABhAAAAAABhEAAABdY2FsYy5leGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgBA8AAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkSAAAACRMAAAAJFAAAAAQSAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BhUAAACwAlN5c3RlbS5GdW5jYDNbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GFgAAAEttc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkKBhcAAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQYYAAAAGlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzBhkAAAAFU3RhcnQJGgAAAAQTAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyBwAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlClNpZ25hdHVyZTIKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQEAAwgNU3lzdGVtLlR5cGVbXQkZAAAACRcAAAAJGAAAAAYeAAAAPlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzIFN0YXJ0KFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBh8AAAA+U3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MgU3RhcnQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEUAAAAEwAAAAYgAAAAB0NvbXBhcmUJFgAAAAYiAAAADVN5c3RlbS5TdHJpbmcGIwAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBiQAAAAyU3lzdGVtLkludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEaAAAAEgAAAAYlAAAAcVN5c3RlbS5Db21wYXJpc29uYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCRYAAAAKCRYAAAAJIgAAAAkgAAAACgs=

Here's a special string. I'll explain what it's for during my talk later today at #NDCSecurity :

DAwAAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQULAAAAhAFTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5Tb3J0ZWRTZXRgMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAABUNvdW50CENvbXBhcmVyB1ZlcnNpb24FSXRlbXMAAwAGCI0BU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuQ29tcGFyaXNvbkNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCAwAAAACAAAACQ0AAAACAAAACQ4AAAAEDQAAAI0BU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuQ29tcGFyaXNvbkNvbXBhcmVyYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dAQAAAAtfY29tcGFyaXNvbgMiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgkPAAAAEQ4AAAACAAAABhAAAAAABhEAAABdY2FsYy5leGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgBA8AAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkSAAAACRMAAAAJFAAAAAQSAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BhUAAACwAlN5c3RlbS5GdW5jYDNbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzLCBTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0GFgAAAEttc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkKBhcAAABJU3lzdGVtLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQYYAAAAGlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzBhkAAAAFU3RhcnQJGgAAAAQTAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyBwAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlClNpZ25hdHVyZTIKTWVtYmVyVHlwZRBHZW5lcmljQXJndW1lbnRzAQEBAQEAAwgNU3lzdGVtLlR5cGVbXQkZAAAACRcAAAAJGAAAAAYeAAAAPlN5c3RlbS5EaWFnbm9zdGljcy5Qcm9jZXNzIFN0YXJ0KFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBh8AAAA+U3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MgU3RhcnQoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEUAAAAEwAAAAYgAAAAB0NvbXBhcmUJFgAAAAYiAAAADVN5c3RlbS5TdHJpbmcGIwAAACtJbnQzMiBDb21wYXJlKFN5c3RlbS5TdHJpbmcsIFN5c3RlbS5TdHJpbmcpBiQAAAAyU3lzdGVtLkludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykIAAAACgEaAAAAEgAAAAYlAAAAcVN5c3RlbS5Db21wYXJpc29uYDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dCRYAAAAKCRYAAAAJIgAAAAkgAAAACgs=

I'm flying to Norway tomorrow morning for #NDCSecurity .

I'll be talking about #serialization , and much of my talk will resemble the talk I gave at DEFCON last year, though I'm also going to describe a new set of techniques for exploiting #BinaryFormatter .

I'm flying to Norway tomorrow morning for #NDCSecurity .

I'll be talking about #serialization , and much of my talk will resemble the talk I gave at DEFCON last year, though I'm also going to describe a new set of techniques for exploiting #BinaryFormatter .

I've arrived in Oslo, Norway for #NDCsecurity 🎉

I've arrived in Oslo, Norway for #NDCsecurity 🎉

Who has two thumbs, purple hair, and just landed in Heathrow airport on her way to #NDCsecurity? Meeeeeeee

Who has two thumbs, purple hair, and just landed in Heathrow airport on her way to #NDCsecurity? Meeeeeeee

I'll be speaking at the #NDCSecurity conference in Oslo in January: https://ndc-security.com/speakers/jonathan-birch

The content will partially be a reprise of the #serialization talks I gave a BlackHat and DEF CON, with some new findings from research I and and a few other folks have done since then.

I've never been to Norway before. I expect it will be fun🙂​

I am truly honored to have been selected to speak at #NDCSecurity. The staff were so welcoming. #NDC Secuity had incredible speakers on deep and engaging topics. Norway has been amazing. We’ve loved touring around Oslo. The museums are incredible. The food was great. Coffee everywhere! Everyone was nice and we had great conversations.
I hope I can return. Either to speak again or just to visit.

I am truly honored to have been selected to speak at #NDCSecurity. The staff were so welcoming. #NDC Secuity had incredible speakers on deep and engaging topics. Norway has been amazing. We’ve loved touring around Oslo. The museums are incredible. The food was great. Coffee everywhere! Everyone was nice and we had great conversations.
I hope I can return. Either to speak again or just to visit.

Had a great experience at #NDCSecurity after my talk, "In Defence of PHP".

Chatting to a couple of pentesters, they said every time they encounter a #php site in their job, they don't bother attacking it. It's far too hard to attack the app without the framework getting in the way, and the framework is generally bulletproof. They asked me how I did it, and my answer is simple: I cheat and read the code. It's the only way to know where to go looking and not waste your time on the framework.

Such a great validation of my talk and my view that modern PHP is secure! 😎

Today was great! Despite not having slept much, my presentation went well and was generally well-received. Also got the chance to see a few good talks. And to finally get to meet @magnologan, after having known each other online for a long time. Also happy to meet @Chrisayers, @webtonull and many others. Great conference! 🇳🇴

#NDC #Security #NDCSecurity #ndcoslo

My slides for my talk at #NDCSecurity today
"Return Oriented Programming, an introduction"
https://www.slideshare.net/PatriciaAas/return-oriented-programming-an-introduction

My slides for my talk at #NDCSecurity today
"Return Oriented Programming, an introduction"
https://www.slideshare.net/PatriciaAas/return-oriented-programming-an-introduction

Great talk on OPA and IR by @anderseknert at #NDCSecurity

Great talk on OPA and IR by @anderseknert at #NDCSecurity

After 27 days in the UK, it's time for me to leave. I'm flying to Oslo for #NDCSecurity today!

As a Brisbane native, I don't think I'm ready for the cold...

Breakfast here at the hotel for #NDCSecurity #NDC is amazing.

Breakfast here at the hotel for #NDCSecurity #NDC is amazing.

Boarded and ready to go to Oslo Norway for #NDCSecurity #NDC. It is an amazing honor to share with everyone my talk on “Securely deploying Infrastructure as Code”. I am so excited!!

Boarded and ready to go to Oslo Norway for #NDCSecurity #NDC. It is an amazing honor to share with everyone my talk on “Securely deploying Infrastructure as Code”. I am so excited!!

Just got home from an amazing #codestock. All packed up for Oslo Norway and #NDC #NDCSecurity. Come see my talk on “Securely deploying Infrastructure as Code”. I’ll have lots of demos and code samples.

Just got home from an amazing #codestock. All packed up for Oslo Norway and #NDC #NDCSecurity. Come see my talk on “Securely deploying Infrastructure as Code”. I’ll have lots of demos and code samples.

My slides for #NDCSecurity Oslo are finally complete! 🎉
43 slides for 60 minutes sounds about right, although I haven't done a run-through yet. 🤞

Once this is ready, I can build my #LaraconEU talk.

Ok folks, I'm speaking at https://ndc-security.com in a few weeks, "In Defence of PHP".

What are your favourite PHP security features found in Core PHP and/or Frameworks you use?
What about 3rd party packages?
What security tips would you give PHP newbies?
#PHP #Laravel #Security #NDC #NDCSecurity