This meeting, we talked about what networking is, layers of the OSI model, showing how they fit into real world usage. We also went over core networking devices and how they create LANs, WANs, and the internet.
Slides: Networking_and_Firewalling.pdf
Cybersecurity News Headlines:
This week, we had represents from Booz Allen's Vehicle Cyber Analysis Center talk about the state of car cybersecurity. We examined how the numerous networks on modern cars can leave significant amounts of forensics data behind and the potential vulnerabilities in these systems.
Cybersecurity News Headlines:
This week, Jake gave a talk on some basic tools and techniques we can use to detect and remove malware. Specifically, we explored using ClamAV and SysInternals' Autoruns to identify anomalous behavior. After the introduction and overview, we practiced using the tools to respond to a live malware infection in the lab where our Domain Controller had been infected.
Slides: MalwareDetectionAndRemoval.pdf.pdf
Cybersecurity News Headlines:
Daniel gave a presentation on the mindset of exploit development. We went over the importance of arbitrary reads and writes, and practiced exploiting format string vulnerabilities to get flags
Slides: Arbitrary_reads_writes_and_Format_String_presentation.pdf
Cybersecurity News Headlines:
This week, Jake gave an introduction to penetration testing and red teaming as we worked to exploit the ETERNALBLUE vulnerability. In addition, we also practiced some basic persistence commands and successfully applied the MS17-010 patch to mitigate this attack.
Slides: SpawningYourFirstShell_EternalBlue.pdf
Cybersecurity News Headlines:
Roman gave a presentation on XSS and we practiced exploiting this vulnerability on a vulnerable site that Roman set up.
Slides: XSS_and_SQL_Injection.pdf
Cybersecurity News Headlines:
Sam gave a presentation about API security, sharing of his experience with using APIs and some of the dos and don'ts of API security.
Slides: Do's_and_Don'ts_of_API_Security.pdf
Cybersecurity News Headlines:
Presentation: Mariah and Jake gave a talk this week about the Collegiate Cyber Defense Competition (CCDC) and the plans to start getting ready for the 2019 season.
Cybersecurity News Headlines:
Presentation: Daniel gave a talk this week on the concept of fuzzing in order to find vulnerabilities and logic flaws in binary applications. In addition, we practiced solving some recent CTF challenges, applying the ideas from the talk to get flags!
Slides: Fuzzing_for_Vulnerabilities.pdf
Presentation: Calvin gave a talk on the basics of Windows Security and the quickest wins that provide the most protection with hands-on demos and exercises. We explored how sometimes simple, built-in features can be used to provide strong security gains especially in competitions like CCDC.
Description: This week, we spent another week working on CTF problems in order to get ready the upcoming MetaCTF and patriotCTF events at UVA and George Mason, respectively.
Cybersecurity News Headlines:
Presentation: Jack and Jake gave an overview of blockchain, Ethereum, Smart Contracts, and why we care about them in security. We looked at an example smart contract written in Solidity and deployed on the blockchain and web3 commands that allow us to interface with the blockchain/store data. After the introduction, students began to work on the NSA Codebreaker Challenge.
Slides: Ethereum_SmartContracts.pdf
Presentation: This week, we spent the meeting learning what CTFs are and working through some sample problems. Then, students worked in teams on PicoCTF as they get ready for MetaCTF @ UVA later this month.
Presentation: We had Vernon McCandlish, a Sr. Incident Responder at General Electric, come in to talk about everything from home labs to malware to career paths in cybersecurity. He talked about some of his favorite tools and gave advice on how you can "break" into the security field.
Cybersecurity News Headlines:
Presentation: Roman talked about networking basics including various ports and protocols and tools such as Wireshark.
Slides: Introduction_to_Networking.pdf
Cybersecurity News Headlines:
Presentation: Jake walked through the recent cybersecurity news before walking through basic reverse engineering and malware analysis. We covered some of the basic commands to analyze an unknown file, more advanced tools like HxD and IDA, and briefly discussed how we can fingerprint malware through YARA rules.
Slides: Intro_Reverse_Malware_Analysis.pdf
Cybersecurity News Headlines:
Presentation: Jake and Roman went over major security new since our last meeting in the spring, introduced what we do in the CNS, talked about topics for future meetings and gave an overview of our team's performance at this year's Collegiate Cyber Defense Competition(CCDC).
Slides: Welcome_and_Intro.pdf
Cybersecurity News Headlines:
Presentation: Jake and Mariah gave a talk this evening introducing the basics of assembly, GDB/PEDA, and binary exploitation. In addition, we practiced examining actual binaries from CTF competitions in order to find the flags.
Slides: Intro_Binary_Exploitation.pdf
Cybersecurity News Headlines:
Presentation: Roman gave a talk this evening about Cross Site Scripting (XSS) flaws. We looked at what this vulnerability is and practiced exploiting it to steal session cookies or other information.
Slides: Cross_Site_Scripting_XSS.pdf
Cybersecurity News Headlines:
Presentation: Roman gave a talk this evening about basic Linux security including how user info is stored, attacker persistence mechanisms, and helpful command line tools. In addition, we looked at how to exploit path traversal vulnerabilities.
Slides: Linux Security Basics.pdf
Welcome to the CNS blog!
Although this organization has members who are University of Virginia students and may have, University employees associated or engaged in its activities and affairs, the organization is not a part of or an agency. It is a separate and independent organization, which is responsible for and manages its own activities and affairs. The University does not direct, supervise or control the organization and is not responsible for the organization’s contracts, acts or omissions.
© CNS@UVA