Speaking Slot

Speaker

Bio

Topic title

Summary of topic

9-10

Christopher Doman

Resource-Level Cloud Forensics

Cloud Service Providers, such as AWS, GCP and Azure, often introduce artifacts of forensic value when developing features for automation and monitoring of resources. Typically, these artifacts are undocumented and exist purely for the provider’s own troubleshooting, but they also provide valuable insight to an investigator analysing malicious activity on a system. Frequently, this insight surpasses that of “provider-supported” forensic data sources.

Most of the discourse around performing forensics in the cloud focuses on provider-level logging. While this is undoubtedly useful, practitioners understand that resource-level forensic analysis is crucial when responding to incidents affecting cloud infrastructure - and much of this knowledge remains opaque and undocumented.

In this presentation, Chris Doman, co-founder of Cado Security, will present novel research of undocumented forensic artifacts from cloud service provider specific operating systems and tools. They will provide the audience with an overview of forensic techniques across cloud compute and serverless environments. Native operating system artifacts will also be discussed and contrasted with their cloud equivalents, with consideration given to their usefulness in the context of the cloud.

10-11

Matt Danner

Founder

Monolith Forensics LLC

Neptune, a tool that helps ICAC investigators review CyberTips

• TBD

11-noon

Thiago Bordini

Thiago Bordini, Head Cyber Threat Intelligence at Axur, executive with more than 20 years of experience in the cyber intelligence market, working with analysis and prevention of cyber threats and fraud and dissemination of educational content on the subject to professionals and companies. Technical coordinator and postgraduate professor at IDESP. Speaker at several national and international events such as YSTS, EkoParty, H2HC, Security BSides, SANS, HTCIA, CoronaCon, 8.8 Andina and Brazil, among others. Member of the HTCIA (High Technology Crime Investigation Association). Member of the Security BSides Sao Paulo/Brazil organization.

https://www.linkedin.com/in/thiagobordini/ 

The LATAM DeepWeb. How LATAM fraud groups work on Telegram and WhatsApp

• https://www.papercall.io/speakers/tbordini/speaker_talks/255098-the-latam-deepweb-how-latam-fraud-groups-work-on-telegram-and-whatsapp

• Elevator Pitch

  • Many investigative agents talk about cybercrime on Deep and Darkweb, but in LATAM the reality is a little different. The study shows an insight into how groups act, the main scams and especially how the use of counterintelligence can help in gathering information about targets.

• Description

• I. INTRODUCTION

  • Many investigative agents talk about cybercrime on Deep and Darkweb, but in LATAM the reality is a little different.

  • Given the lenient legislation, and cyber investigative difficulties, Whatsapp and Telegram are now part of the largest network for fraud-related activity and other illicit activities in the country. 

  • Today it is possible to buy counterfeit notes, machines infected with banking trojan, phishing campaigns, orange accounts, credit cards, internet banking access data, personal documents such as RG, CPF (Social Number), CNH (Drive License), Birth Certificate among others, database, pay TV, payment of bills and taxes, drugs, among other "products and services".

• II. OBJECTIVE

  • The proof of concept presented in this study demonstrates how simple counterintelligence techniques can be great allies in investigative processes.

• III. STRATEGIC

  • The study presents a strategic analysis on the main illicit actions mapped, payment methods used, amounts involved, among other issues, from the technical point of view will be presented the counterintelligence techniques adopted during the study phase, the effectiveness of each of them, as well as technical indicators such as VPN providers used, cloud providers, among other aspects.

• IV. RESULTS

  • The result includes a broad analysis performed through counterintelligence techniques, where it was possible to map the main Techniques of OPsec employed by the attackers, which operating systems used, providers, geographic region among other information that will be presented during the lecture.

• 
  

Closing

5-15 minutes

Chapter President

Current Chapter President

Chapter Business

• When should the next meeting be?

  • 2024-01-12

• Where should our Next meeting be?

  • 
    

• Any items to bring up? 

  • Elections. Current Chapter board terms end in 2023, and the handover to the new board officers  will happen at our meeting in January 2024.
  • Thank you everyone for your support for the past few years of my Presidency. It was a rough transition between virtual and in-person meetings and a very geographically diverse membership. Thank you all for your patience and support! 
  •