Previous Years
Explore the rich history of our conference through past speaker schedules and highlights.
The Midnight Sun CTF has been held since 2018, bringing together cybersecurity enthusiasts from around the world. The conference component was introduced in 2021, adding policy and technical talks to complement the CTF competition.
2025
Talks
Opening Keynote
Speaker Bio
Carl-Oskar Bohlin has been a member of the Riksdag (Parliament) since 2010 and has served in the Moderate Party cabinet as the Minister of Civil Defence since 2022, making him the first Minister of Civil Defence as Sweden joined NATO.
Shadows and Strategy: Cybersecurity in the Gray Zone
In today's hyper-connected world, cybersecurity isn't just about firewalls and forensics—it's about strategy. Drawing from her experience with U.S. and international defense institutions, Dr. Mary Bell explores how cyber operations increasingly operate in the "gray zone"—the murky space between peace and declared conflict. Through historical parallels, like Stockholm's layered island defenses, and real-world cyber incidents, this talk challenges attendees to rethink cybersecurity through a strategic lens. Mary will introduce emerging models of cyber deterrence, highlight lessons from joint military education programs, and call for coalition-based, resilience-driven approaches to digital defense. Designed to provoke discussion, this session is ideal for policy makers, cyber professionals, industry leaders and educators preparing for the next frontier of conflict: the shadows.
Speaker Bio
As Dean of The Beacom College of Computer and Cyber Sciences at Dakota State University, Mary leads the strategic development of academic programs ranging from certificates to doctoral degrees in fields such as Artificial Intelligence, Computer Science, Cyber Defense, Cyber Operations, Ethical Hacking, and more. She is actively involved in curriculum development, faculty mentorship, and fostering partnerships that enhance research and experiential learning opportunities for students. Under her leadership, the college has introduced innovative programs, including a Master's in Artificial Intelligence and a Quantum Computing Certificate, reflecting her commitment to preparing students for emerging fields in technology and cybersecurity. Mary also plays a key role in advancing DSU's reputation through collaborations with national and international organizations, ensuring that students and faculty contribute to cutting-edge advancements in cyber sciences.
The First-of-a-Kind Cyber War in Human History
This presentation explores Ukraine's experience as the first nation to endure full-scale cyberwarfare as part of an ongoing military invasion. It will examine how cyber operations have been integrated with kinetic warfare since 2014, culminating in a continuous hybrid campaign after the full-scale Russian invasion in 2022. The talk will provide real-world examples of cyberattacks on national infrastructure, their strategic objectives, and the responses developed by Ukrainian cyber defenders. It will also highlight how Ukraine's experience reshapes the global understanding of war, demonstrating that cyberwar is not a separate phenomenon but a persistent and evolving front of modern conflict.
Speaker Bio
Ievgen Vladimirov is the Director of the Cybersecurity Center at the National Academy of Security Service of Ukraine. He previously served as Deputy Minister of Energy of Ukraine for Digital Development, Digital Transformations, and Digitalization. His roles have included founding national cybersecurity structures, advising multiple Ukrainian ministries, and contributing to key legislation and concepts such as the "Energy Sectoral Cybersecurity Concept" and the "Critical Infrastructure Law of Ukraine." Ievgen brings over 20 years of experience at the intersection of cybersecurity, energy, and national defense, combining public service and private sector expertise.
Adapt, Evade, Evolve: Russia's Cyber Industry, the Russian War on Ukraine, and Future Risks and Implications for Europe
After Russia's full-scale invasion of Ukraine in February 2022, Western governments imposed waves of sanctions, export controls, and other restrictions on Russia, including to undermine its cyber capabilities and defense technology. But Russia's cyber industry—including companies that support the Russian state's offensive and defensive operations—has proven remarkably resilient in the face of sanctions, other restrictions, and shifts in technological isolation. Some Russian cyber firms made more money in 2024 than in their entire history. This talk will explore the role of private companies in the Russian cyber web, how major Russian cyber firms are adapting to the new geopolitical environment, and what it all means for Sweden and Europe—ranging from benign, cybersecurity-positive activities in Russia to private firms that use their capital, resources, and talent to make the Kremlin's cyber offense stronger.
Speaker Bio
Justin Sherman is a leading expert on cybersecurity and data privacy, technology and internet policy, and geopolitics. Described by NPR as "the go-to guy on all things cybersecurity, data privacy, AI," he has consulted for and advised CEOs, government officials, investors, attorneys, product managers, communications strategists, and threat intelligence teams, including in volatile, complex, and high-risk scenarios. He has consulted on projects and programs for organizations ranging from HBO to DARPA.
Crafting Data-Driven Narratives from the Cyber Threat landscape
Learn how SEB reinforces a good security culture with the help of Threat Intelligence. How they create a real-life relevant and common thread from Threat Actor TTP all the way to CIS Controls. Making the Threat Landscape tangible and directing decisions on security.
Speaker Bio
Sofia Nacke works as a Cyber Threat Intelligence Analyst at SEB. She joined the bank in January 2024 and has experience from working with cyber-related issues in both the public and private sector. Sofia has a B.Sc. in Information Systems.
Kristoffer Sjöström is the Chief Security Officer for the SEB Group and Head of Group Security and Cyber Defence. He joined SEB in October 2021 and previously held numerous senior security positions at Ericsson where he worked for over 17 years. Kristoffer holds a B.Sc in Security and Business Management.
Tobias CalĂĄs leads the Threat Intelligence team as part of Group Security & Cyber Defence at SEB. He joined the SEB Group in 2023 from the Swedish Armed Forces where he has served for many years in various positions. Tobias held the rank of Lieutenant colonel, has a M.A in war studies and a B.A in political science.
Co-operation is a key to success in the complex cyber world
The world of cyber is complex - and it will be even more complex in the future. There are no borders and information can be distributed in the flip of the eye to anywhere. In this world, no authority nor company or entity can survive on its own. There is a high need for co-operation in all levels in order to identify the week parts and make them stronger.
Speaker Bio
Pekka Jokinen works as a deputy director general at National Cyber Security Center Finland. His main responsibility is to lead center's day to day work, lead the preparedness and readiness of the center as well as all cooperation internally in Finland and internationally. Mr Jokinen has 20 years of background from the Finnish Defence Forces. Jokinen is a general staff officer and has served multiple positions in Armoured Brigade, Karelia Brigade and Defence Staff. His last appointment at Defence Staff was to be responsible of the strategic planning at cyber defence.
From concern, to desperation to total worldwide crisis - tons of abbreviations and bad vibes
War in the Smartphone Age: Conflict, Connectivity and the Crises at Our Fingertips
Thanks to smartphones, war is everywhere, all the time. Anyone can view, analyse and comment on photos, videos or other warzone media, far from the frontlines. Where did this technology come from? And what does it mean for the future of war?
Speaker Bio
Matthew Ford is an academic focusing on war and the data-saturated battlefields of the 21st century ans is currenlt working on his third book, topic of this talk.
Supply chain management during the time of hybrid wa
We are living in a new world. States, organisations and individuals that earlier where friends today are furious enemies, or question each other. The amount of trust that is needed is decreased to a level we have not seen for years. For the cyber arena that is like moving from Fontana di Trevi to the floor of Colosseum in Rome in the days lions where mixed with humans there. Have we been too naive? Can we trust each others? How to we plan for continuity? Mr Fältström will talk from his experience in the intersection between cyber defence and cyber security how to handle relationships between organisation in the new world.
Speaker Bio
Patrik Fältström is Head of Security at Netnod and holds a Master of Science degree in Mathematics from Stockholm University. He has extensive experience in Internet technologies, having worked with UNIX since 1985, DNS since 1987, and contributing to Internet standardization through the IETF, including editing standards for Internationalized Domain Names and ENUM. Fältström has held key roles in global Internet governance, including chairing the ICANN Security and Stability Committee and advising the Swedish IT Minister. He is a member of The Royal Swedish Academy of Engineering Sciences and a Knight of The Order of the Cross of Terra Mariana.
89 Seconds to Midnight...
In January, the Doomsday Clock moved one second closer to midnight - the closest it has ever been to catastrophe. The world which we believed we understood has changed. We have entered a new era of competition, confrontation and instability. The Rules Based International System is under threat and Europe's security is at stake. Our new reality requires new ways of thinking. What will be the effects on innovation, technical development, and international cooperation? Is there a silver lining?
Speaker Bio
Judith Gough is Senior Strategic Advisor at Actagon. A career diplomat, she has served as the UK's Ambassador to Sweden, Ukraine and Georgia. Her background is in defence, security and conflict and Europe's relationship with Russia. She is an Associate Fellow at Chatham House and a regular media commentator on Russia's war in Ukraine and the new world order.
EntrySign: The Story of AMD's Microcode Signature Vulnerability
Microcode is a fundamental building block for x86 CPUs – implementing everything from complex x86 instructions, to privilege transitions and virtualization. Beyond ring 0 and SMM lies the microcode privilege level, with maximum control over the x86 core and the internal buffers within. Accessing and tinkering with microcode is a hacker's dream, but cryptographic protections prevent all but Intel and AMD from doing so. Previous work has demonstrated methods to bypass microcode patch authentication on the Intel Atom and reverse engineer the microcode ISA enough to write sophisticated custom microcode patches (Intel Atom Goldmont and AMD K8/10). However, easily accessible arbitrary microcode execution was unavailable on modern high-performance CPUs until now. Get to know the full details about EntrySign, a cryptographic flaw in AMD's microcode patch verification logic, including how we discovered the bug and how you can extend our results. EntrySign lets you execute arbitrary microcode on all AMD CPUs from Zen 1 to Zen 5 and modify the behavior of x86 instructions. The talk contains details about the format of AMD microcode, how their patches are verified, how we were able to reverse engineer this process, and how we were able to access the key information required to defeat it.
Frontier AI: A New Paradigm for Cybersecurity
Foundation models aren't just another software tool—they're poised to become the universal runtime for almost every digital interaction. Soon, most software won't be built; it will be prompted. Yet the cybersecurity playbook still targets traditional code, blind to AI-native threats like prompt injection, stealthy data poisoning, and autonomous agent hijacks. This talk highlights mechanistic interpretability (reverse-engineering neural circuitry) and adversarial robustness (withstanding targeted attacks) as essential, emerging frontiers in AI security, revealing why defending foundation models demands radically new thinking. Ignoring AI security won't stop LLMs from running your bank, doctor, and car—better catch up quick!
Speaker Bio
Juan Rocamonde holds a BS in Theoretical Physics from University College London and MS in Mathematics (Part III) from Cambridge University. Juan has conducted research in fundamental AI research (NYU CILVR), AI for scientific discovery (CERN, AstraZeneca), and AI safety and security (Stanford University, FAR AI).
Operational Realities in Securing space systems
Our modern society benefits a lot from space systems like GPS, communications, weather or remote monitoring satellites. The satellite systems are very far away and hard to patch and update while at the same time being accessible from anyone on earth with the right equipment and competence. The satellites tend to have a lifespan of 3-10 years in low earth orbit (LEO) or even more than 15 years in geostationary orbit (GEO) so there are likely vulnerable systems on board. This talk highlights some aspects of attacking space systems, looking at known attacks on space, ground and customer assets and how we can defend space systems in orbit around earth and all the way to Mars where a Public Key Infrastructure has some limitations!
Speaker Bio
Mattias has a Master of Science in Mechanical Engineering and 20 years of experience working with IT, information security and threats to critical infrastructure. Mattias is currently the CISO at the Swedish Space Corporation a global Space Service Provider with 10 satellite ground stations on 5 continents and a new launch center in northern Sweden that will launch satellites into orbit in 2025. Mattias has worked with cyber security both as a consultant to private business and within the Military Intelligence and Security Directorate in the Swedish Armed Forces.
You're fuzzing it wrong – Common Mistakes and Tips for Fuzzing in Software Development
Despite the growing popularity of fuzzing in vulnerability research and software development, many attempts remain ineffective, often due to fundamental implementation errors that frequently go unnoticed. This talk aims to demystify the "art of fuzzing" and provide participants — hackers, researchers and developers — with practical insights into correctly implementing and evaluating fuzzing. I will address common misconceptions, present best practices, and demonstrate through examples how effective fuzzing can significantly enhance software security - or just find a lot of bugs. Prerequisites: Participants should have at least basic familiarity with fuzzing. Those already practicing fuzzing will benefit the most from this talk.
Speaker Bio
Marc Heuse is an old-school hacker and security researcher with 30 years of experience in IT security. He founded the hacker research group "The Hacker's Choice" (www.thc.org), the AFLplusplus organization for more efficient fuzzing, and is the lead developer of AFL++, currently the best fuzzer available. At SRLabs, an Allurity daughter company, he leads the software security assessment team.
Building the Cyber-Talent Pipeline with CTFs
I didn't plan on building a top-3 global CTF team, I just thought "TheHackersCrew" sounded cool for a YouTube channel. One accidental click on CTFtime later, I never saw a normal weekend again. This talk is a player's-eye view of how CTFs shape people: how they teach you to think, fail, collaborate, lead, and obsess over the weirdest technical problems. We'll explore how CTFs surface raw skill, persistence, and collaboration under pressure and how companies can use them to build high-trust, high-performance security teams.
Speaker Bio
Rudraksh Saini currently works as a consultant at undisclosed. He is also the founder and captain of 'TheHackersCrew,' one of the top-ranked Capture the Flag (CTF) teams.
Jonathan Ho is a leader of TheHackersCrew. He joined the team in 2021, specializing in the following CTF categories: reverse engineering, hardware, programming, and miscellaneous (networking, cloud, AI, etc.). He was the captain of Santa Clara University's cybersecurity competition team (BroncoSec) from 2021-2022 and member of the United States Cyber Team from 2022 - 2024.
Moderator
Bio
Oscar Jonsson is known for his deep knowledge in security policy, Russia, new technologies, geopolitics, and modern warfare. He has spoken before ministers, generals, business leaders, and professionals, helping listeners navigate through the complex crises, conflicts, and wars of our time. Oscar A. Jonsson presents his lectures in an educational and engaging manner by skillfully connecting the past, present, and future. Oscar Jonsson has a PhD in war studies from King's College London and is the author of the book "The Russian Understanding of War." The book has been awarded a prize from the U.S. Department of Defense and is included on reading lists for military commanders around the world, including leaders within the U.S. special forces, the head of the Royal Air Force, and the Chief of the Swedish Air Force. Throughout his career, Oscar A. Jonsson has gained solid experience from the headquarters of the Armed Forces and has conducted field studies of Russian warfare in Russia, Ukraine, and Georgia. He also works as a trainer for American diplomats preparing for service in Moscow. His pedagogical ability is clearly visible on stage, where he skillfully weaves the audience's thoughts and questions into his lectures. Oscar Jonsson has extensive experience in lecturing corporate management and authorities on the geopolitical consequences of security policy, particularly regarding Russian security policy. He is a frequently consulted expert in the media and gives lectures in both Swedish and English.
2024
Talks
Take the Offensive Against Ransomware: Harnessing Threat Intelligence for Proactive Protection
In today's ever-evolving threat landscape, ransomware attacks have become increasingly intricate. To effectively prevent these malicious incidents, it is imperative to grasp their origins, evolving tactics, and emerging trends. This presentation will delve into the depths of the ransomware market, explore what is changing, evaluate potential impacts, and provide proactive strategies for staying ahead of these attacks. Key topics include:
- Unveiling the current state of ransomware markets and recent ransomware trends
- Strategies and methodologies to prevent ransomware
- Real-world insights: how to use threat intelligence to mitigate ransomware risks to your organization
Speaker Bio
Julius is currently the Sales Engineer for the Nordics region at Recorded Future. He has been at the company for over five years and spent the majority of his time within the Intelligence Advisory Services team enabling some of the largest companies in the Nordics to develop their security strategy through the effective use of intelligence data and automation.
Keynote address: Cyber Conflict; The Tools and Techniques of Tomorrow
Speaker Bio
Carl-Oskar Bohlin has been a member of the Riksdag (Parliament) since 2010 and has served in the Moderate Party cabinet as the Minister of Civil Defence since 2022, making him the first Minister of Civil Defence as Sweden joined NATO.
Lightning talk: Perspectives from Swedish (Civilian) Armed Forces
Speaker Bio
Charlotta RidderstrĂĄle has spent the last 10 years working for Swedish (Civilian) Armed Forces on various projects:
- Coordinated the establishment of the conscripted cyber soldier and specialist officer education for the SwAF.
- Member of the group that established the Center of CDIS, Center of Cyber defense and Information Security.
Background in space industry 22 years, working for the Swedish Space corporation and SES ASTRA as a project manager.
Cybersecurity - Panel
How and why to build your own emulator for kernel snapshot fuzzing
In this talk we will justify building an system emulator from scratch to fuzz hard-to-reach areas of the linux kernel. We will discuss design choices and tricky implementation details.
Speaker Bio
Joel is a security researcher focusing on low level kernel stuff. He has a lot of experience developing fuzzers and emulators from scratch and specializes in harnessing systems to facilitate testing and introspection.
Russia's Cyber Power Base: From Cybercriminals to Private Contractors
The Russia-Ukraine War has significantly impacted Russia's cyber ecosystem and the strategy, policy, and operations affecting and carried out by a web of criminal hackers, military and intelligence officers, and private-sector cybersecurity firms and state contractors. These cyber activities and evolutions impact Russian citizens, the Russian state's ability to launch offensive operations against Western powers, and the future of Moscow's technology ecosystem. Justin Sherman will present new findings from Margin Research's data and OSINT analysis of Russian cyber power during the Russia-Ukraine War and specific Russian cyber actors supporting the Kremlin.
Speaker Bio
Justin Sherman is the founder and CEO of Global Cyber Strategies, a Washington, DC-based research and advisory firm, as well as a nonresident fellow at the Atlantic Council and an adjunct professor at Duke University. He works with New York-based cybersecurity company Margin Research on open-source software security, malicious code, and Chinese and Russian cyber threat actors and operations. He has written and consulted extensively on Russia's internet, information, technology, and cyber strategy, policy, and operations.
6G networks - yet another critical infrastructure: opportunities, threats and new security features
With the upcoming shift from 5G to 6G networks, trustworthiness will be an important cornerstone delivering trusted communication and computing for industry and society relying on critical information. This transition from secure communication to trustworthy platforms—expanding the scope from protecting data to ensuring the end-to-end service delivery in a wide range of relevant scenarios - will pave the way for wireless networks increasingly becoming critical components of society. Resilience and security capabilities are crucial as networks must be able to provide service when part of the infrastructure is disabled due to natural disasters, local disturbances, or societal breakdowns, and they must offer robust resistance against deliberate malicious attacks. 6G networks will be able to leverage new confidential computing technologies, improve service availability, and provide enhanced security identities and protocols with end-to-end assurance.
Speaker Bio
After receiving his master degree in Computer Science and Technology from the Royal Institute of Technology, Stockholm, Sweden, Karl Andersson started his professional career as a consultant, project manager, business developer, and branch manager within the Capgemini Group. Returning to academia as a PhD Student he obtained his PhD degree after defending his thesis "On Access Network Selection Models and Mobility Support in Heterogeneous Wireless Networks". After visiting Columbia University in the City of New York as a postdoctoral researcher and National Institute of Information and Communications Technology, Tokyo, Japan as a JSPS Fellow, Karl is today Professor and Head of Subject, Cyber Security at LuleĂĄ University of Technology (LTU), SkellefteĂĄ, Sweden. During 2017-2023, Karl was leading Centre for Distance-spanning Technology at LTU specialising in research centred around fifth generation mobile networks (5G), Internet of Things (IoT), and datacenters. Moreover, since 1 January 2022, Karl is Dean for Faculty of Science and Technology at LuleĂĄ University of Technology.
Karl is a senior member of the IEEE and a senior member of ACM. He has served as reviewer for a number of journals including IEEE Transactions on Mobile Computing, IEEE Transactions on Computers, IEEE Vehicular Technology Magazine, Computer Networks, Wireless Personal Communications, Wireless Networks, Wireless Communications and Mobile Computing, Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, International Journal of Ad Hoc and Ubiquitous Computing, and ETRI Journal. Furthermore, he has served as reviewer for many conferences including ICC, Globecom, VTC, WCNC, WiMob, IWCMC, and NTMS. Also, he is serving on a number of TPCs and the editorial boards of Journal of Internet Services and Information Security and Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications. During 2020 and 2021, Karl was general chair for IEEE Conference on Local Computer Networks (LCN).
CTI of Sweden
To enhance national security measures, we aim to systematically assess the cyber threat landscape facing our country, Sweden. Our approach entails the comprehensive collection and automated processing of intelligence data to map vulnerabilities within our national infrastructure visible from the internet. Subsequently, we endeavor to predict the likelihood of these systems being compromised by malicious actors and to identify any attacker infrastructures operating within our borders. Initially utilizing open-source intelligence (OSINT) tools for preliminary analyses, we will evaluate their efficacy in bolstering national-scale efforts and determine the most suitable solutions for our needs. This research aims to provide actionable insights and proactive measures to safeguard Sweden's cyber resilience against evolving threats.
Speaker Bio
Emre is a faculty member at Cybercampus Sweden and manager of the Hacking Lab, where he leads a research team working on memory forensics and IoT hacking. He teaches digital forensics at the KTH Royal Institute of Technology.
Key insights from Deputy Minister of Defense for Digital Development, Digital Transformations, and Digitization for Ukraine
Speaker Bio
Kateryna Chernohorenko is the Deputy Minister of Defense for Digital Development, Digital Transformations, and Digitization. Since the inception of the Ministry of Digital Transformation of Ukraine, she has become part of the reform team. She launched next-generation electronic services: eMalyatko, electronic sick leave, and the COVID certificate in the Diia mobile application. When the full-scale war began, Kateryna worked on strengthening the technological component of the Security and Defense Forces, initiating the launch and leading the Army of Drones project.
Talk
Speaker Bio
Erik, a recent graduate from the KTH (Royal Institute of Technology) Cybersecurity Master program, works as a research engineer at the Cybersecurity unit at RISE.
His primary research interests lie in fundamental computing problems and language security. In practice, he enjoys looking at resource-constrained embedded devices and IoT devices.
His passion for work in cybersecurity got kickstarted with a university course in Ethical Hacking and was further amplified by joining and participating in numerous CTF competitions with the team RoyalRoppers where he specializes in reverse engineering and pwn. A fun challenge that he often undertakes is attempting to distill hard-earned insights and experiences into educational material that make hard problems more approachable.
Some insights from serial founder and bug bounty MVP
Speaker Bio
Rosen has expertise in offensive security, penetration testing, and vulnerability research. With years of experience in the field, Rosen has established himself as a leading figure in cybersecurity.
Throughout his career, Rosen has worked on numerous high-profile projects, helping organizations identify and address vulnerabilities in their systems and networks. His work in offensive security has earned him recognition for his technical proficiency and innovative approach to cybersecurity challenges.
In addition to his practical experience, Rosen is actively involved in the cybersecurity community, sharing his knowledge through conferences, workshops, and publications. He is passionate about educating others and promoting best practices in cybersecurity.
Rosen's dedication to the field and his commitment to staying at the forefront of cybersecurity trends make him a respected authority in the industry. He continues to make significant contributions to the field, helping organizations stay ahead of cyber threats in an ever-evolving landscape.
Decrypting NordVPN
VPN systems should help protect your communication from network attackers. However, in this talk we will show how we decrypted NordVPN client applications' communication. Not only to intercept your VPN traffic, but also to get access to other devices in your private network.
As we send increasingly sensitive data over untrusted networks, our communication is constantly under attack. Especially while communicating from foreign or hostile jurisdictions, network interception attacks are more a rule than an exception.
Even while browsers and applications try their best to encrypt their communication, they leak metadata and are susceptible to n-day or 0-day vulnerabilities. Encrypting all the communication with a VPN can help mitigate these risks.
Numerous consumer grade VPN providers have been popping up over the years with promises of ease of use while providing military grade protection.
In this talk, we will show how NordVPN failed to deliver on this promise. While being easy to use, it unfortunately was also easy to hack. We will decrypt NordVPNs communication through a network interception attack and hack into other devices in your private network.
Speaker Bio
Aapo Oksman is an entrepreneur and the Founder of Juurin Oy, a cybersecurity company focusing on technical IoT cybersecurity. His background is in electrical engineering, embedded devices, and test automation. Combining his background with a hacking hobby led to a cybersecurity career focusing on industrial IoT.
Bug Bounties and security research keep Aapo motivated and learning. His work in cryptography has resulted in multiple CVEs from vendors like Microsoft, Apple, and Samsung. Outside work and research, Aapo's passion is in the community. He organizes local security meetups and coaches the Finnish national youth CTF team in the yearly European Cybersecurity Challenge competition.
One smali step for a man: a case for taking the middle ground.
I will lament recent frustrations with decompiling APKs:
- decompilers that crash
- decompilers that hide control flow information
And propose that we search for simpler and more robust solutions that still get the job done. I will share my experience with building a Dalvik disassembler and building a graphview on top of it
About the Pwnie Awards
Speaker Bio
Applying "Bartle taxonomy of player types" to CTF challenges.
macOS user privacy protections
In this brief talk we'll discuss macOS user privacy protections and a logic bug in the PackageKit framework which leads to a complete SIP/TCC bypass ( CVE-2023-38609 ) on macOS Ventura. The talk will cover initial discovery, automating variant discovery and chaining with a patched privilege escalation to achieve unrestricted access from a regular user context.
Speaker Bio
Michael Cowell is a cybersecurity engineer and researcher specialising in the iOS and macOS ecosystems with experience in the public and private sector.
Integrating program runtime information with LLMs
This lightning talk will discuss the opportunities and limitations of integrating program runtime information with large language models (LLM) and how this relates more generally to LLMl reasoning capabilities. Additionally, we will explore a new method that combines LLMs with reinforcement learning to pragmatically and efficiently fine-tune models with the most salient runtime information relative to the programmer's existing beliefs of the code they are seeking to understand or generate. Attendees will leave with the ability to - in a matter of hours - add runtime information (both in the form of fine-tuning and prompt engineering) to their hosted models for code generation or analysis.
Speaker Bio
Lauren Moos is a Principal Scientist with experience in machine learning research and enterprise software development. At AWS, she worked on core algorithms for Kinesis and Sagemaker Ground Truth, including Amazon's general anomaly detection algorithm. She led a team funded by DARPA at Special Circumstances on the AIMEE, REMATH, and HARDEN programs, which focused on modeling and assuring computer programs with machine learning. She has published work on LLM reasoning and particle accelerator diagnostics and is currently developing FPGA synthesis tools.
Reagent: Catalyzing Bad Actor Discovery in Open Source
As the open source software (OSS) landscape continues to expand, it becomes a larger playground for cyber adversaries, posing a remarkable challenge for maintaining national cybersecurity. In this enlightening and (hopefully) occasionally humorous talk, we delve into Reagent, Margin Research's trailblazing open source analysis platform, and how it leverages socio-technical analytics to unveil suspicious activities within OSS projects.
Reagent represents a significant evolution in analyzing the complex social dynamics of software development. By integrating graph databases with specialized algorithms with Python heuristics, Reagent transforms how organizations detect and avert threats lurking within vast volumes of OSS contributions. Illustrating its cutting-edge functionalities, we share captivating case studies, such as the infamous "XZ Hack", revealing how Reagent pinpointed bad actors amidst tens of thousands of contributors through adversarial correlation techniques, natural language processing, and anomaly detection.
Guided by an automated approach that analyzes cross-repository metadata using the latest and greatest algorithmic technologies, Reagent not only detects low-profile, yet high-risk users, identifies how palatable a threat is to adversaries, and discovers one-off commits made by aliased git users, but also shines the spotlight on suspicious code contributions and maintainers. From in-depth timezone analysis, to drive-by commit discovery, to sentiment analysis in messages to high-level maintainers, we prove that having the right toolbox can expose even the most sophisticated false users behind supply chain intrusions.
Through the lens of technical storytelling, you'll see not just the software's prowess, but also how the human touch remains indispensable to bad actor discovery. Reagent's versatile queries unearth potential concerns within email domains, timezone spoofing, and coding behavior purity, allowing the integration of humor, such as the bewildering choices of developers to commit code in the future and maintain widely used packages under the moniker "meow", without losing its grip on critical analytics. Additionally, we aim to highlight the ongoing research in vulnerability and bad actor discovery within the open source community by showing that we're continually modifying our approach in response to new threats, as we either discover them in our database, or read about them on the news.
In our concluding reflections, the talk emphasizes the vital role of platforms like Reagent in safeguarding OSS integrity. With real-world applications and a dash of wit, we affirm that combating cyber threats in the digital age requires not just powerful algorithms, but creative and strategic thinking.
Speaker Bio
Alice Bibaud is a Cybersecurity Engineer at Margin Research, specializing in backend engineering and data science. She works with her colleagues every day to catch bad actors in open source, a space she hopes to spread awareness about through her work at Margin.
2023
2022
Talks
Speaker Bio
Colonel Patrik Ahlgren is the Head of Cyber Defence Section at the Command Staff of the Swedish Armed Forces.
Speaker Bio
Carl Fredrik Wettermark is the coordinator for cyber affairs and new technologies at the Swedish Ministry for Foreign Affairs. He works in the intersection of geopolitics, technology and cyber security. Before joining the foreign ministry, he worked in the Swedish startup sector as well as the Armed Forces.
Speaker Bio
Martin Westman has worked in the mobile device technology field since 1994. He has held many roles within MSAB over the last 20 years, bouncing back and forth between tech and development, and he is currently working as Exploit Research Manager. He is part of the Interpol Digital Forensics Expert Group and has on several occasions, assisted law enforcement and government agencies in successfully acquiring mobile data from challenging and complex high-profile cases to support major investigations. Martin is also the only known person to have successfully completed a forensic physical extraction of a phone whilst in freefall. He once combined skydiving with mobile forensics and recorded the moment - to invent a new sport called extreme hexdumping. So far there is only one practitioner.
Speaker Bio
Tracy is a New York City based Lead Security Research Engineer for Trenchant (formerly Azimuth Security). With a degree in Computer Engineering from University of Maryland and over 8 years in the industry, Tracy specializes in vulnerability research, reverse engineering and development for embedded devices. She has led teams focused on telecommunications equipment and has worked on many other devices. Her first degree is in theatre so you may have seen her presenting at conferences, attending trainings or performing on stage.
Speaker Bio
Viivi Lehtinen is a Project Leader (MSSc.) of Cybercrime Exit –NBI's Cyber Offender Prevention program. She is experienced in governmental Security field (National Bureau of Investigation & the Finnish Defence Forces) and management of inter-administrative projects. Viivi has a thing for Cyber, and loves to combine human and technical approach to Prevent juvenile cybercrime. She participated in the making of Generation Z Hack Challenge.
Speaker Bio
Lars Haulin (LarsH) is an experienced CTF player, and has been a member of HackingForSoju since it was founded in 2010. He is a cyber security engineer with passion for for embedded systems, electronics and fancy maths. Besides coaching a student CTF-team at Uppsala University, he also enjoys disc golf, chess and choir music - both as a singer and a conductor.
Speaker Bio
Michael Coppola is the Associate Director of Research at L3Harris Trenchant (formerly known as Azimuth Security). Michael has over a decade of experience in professional vulnerability research and focuses primarily on hacking mobile platforms.
Speaker Bio
David Manouchehri started his professional cybersecurity career half a decade ago after being recruited by the Department of National Defense, and later for Linchpin Labs. Since then, he has found and disclosed half a dozen Chrome 0days.
Speaker Bio
Alex Radocea & Philip Olausson first met at the wargames.unix.se games and have ever since been having fun hacking CTFs as the "lollerskaters dropping from rofl copters" team and playing for "Hacking For Soju". Professionally at longterm they have been training & advising startups to secure their technology.
Previous claims to fame include Calchands.exe — a world's first public memory corruption exploit in Virtual Reality (Steam Engine), cracking iCloud Keychain's end-to-end encryption, decrypting LINE + Kakao encryption over the wire.
Speaker Bio
Jordan Wiens has done: CS, NIDS, RE, VR, MGMT for .EDU, .COM and .GOV, then he was cured from acronymphilia and he co-founded Vector 35 (makers of Binary Ninja) where he is still trying to figure out how to price software and write documentation (both harder than program analysis).
Tom started his career in Biostatistics before moving to Cyber in 2019. He enjoys building scalable data analysis pipelines to support reverse engineer tools, and leveraging ideas from ML and scientific computing to expand what those tools can do.
Speaker Bio
Brandon Falk is a Pwnie award winner for Vectorized Emulation, an extremely high-performance fuzzing engine leveraging AVX-512 SIMD instructions for fuzzing multiple instances of a program in parallel on a single core.
Vectorized emulation easily can handle billions of fuzz cases per second on a single server and can consume over a terabyte per second of fuzz inputs. This leads Brandon down many creative paths of custom operating systems, data structures, protocols, and emulators to generate high quality inputs, handle trillions of instructions per second of emulated execution and coverage reporting, and store all of this information in formats that can be kept in sync between multiple servers with sub-millisecond syncing and statistics reporting for real-time fuzzer monitoring.
Brandon is also known for his popular Twitch and YouTube channels where he experiments and demystifies fuzzing black magic for the masses.
Speaker Bio
Elena Dubrova received the Ph.D. degree in Computer Science from University of Victoria, Canada, in 1998. Since 2008 she has been a professor at the School of Electrical Engineering and Computer Science at the Royal Institute of Technology, Stockholm, Sweden. She has over 100 publications and 15 granted patents. Her work has been awarded prestigious prices such as IBM faculty partnership award for outstanding contributions to IBM research and development. She is in the list of world's top 2% scientists according to the Stanford University ranking from 2020. Her research interests include hardware security, lightweight cryptography, and fault-tolerant design.
Speaker Bio
Travis Goodspeed is an embedded systems reverse engineer from Tennessee, where he drives a Studebaker and collects memory extraction exploits for microcontrollers.
2021
The first conference was held alongside CTF.
Talks
Policies in place – how European and national cybersecurity strategies and policies promote an open and resilient society
Late 2020, the European Commission presented a new EU Cybersecurity Strategy, aimed to strengthen resilience against cyber threats. The EU Council adopted conclusions on the strategy in March 2021, and EU ministers underscored the need for strategic autonomy while preserving an open economy. This presentation outlines the set of strategies and policies in place, and planned, for a range of activities in EU and Sweden, and touches on the implementation in a Swedish context. Topics covered include EU-wide cybersecurity certification schemes and the new, stronger role of the EU Agency for Cybersecurity. The presentation will also give an overview of other related policy initiatives in cybersecurity, and their implications for companies and public sector in the coming years.
Speaker Bio
Dr. Hagdahl works as a policy advisor in cybersecurity and digitalization since more than ten years. She has a Ph.D in informatics and has previously worked in the private sector with project management, standardisation and programming.
If cyber crisis comes: CERT-SE can support you in case of incidents
In July, Coop's grocery stores suffered extensive disruptions to their payment systems due to a exploit of a critical vulnerability in the Kaseya VSA platform. This presentation will, based on the Coop incident, provide clarity on what the incident is about, but above all describe how a national CSIRT and MSB work in the event of an IT-related societal disturbance. This will give you an overview of how an affected organizations can be supported by CERT-SE in its incident response. This applies both to individual organizations have been affected or when the incident becomes more extensive and perhaps affects an entire business sector.
Speaker Bio
Peter JonegĂĄrd has been working at the Swedish National CSIRT, CERT-SE, for five years. Having held different positions att this supporting element in swedish IT security, Peter has gained insights in the challenges of the field and the handling of large incidents.
From cloud to mountains
We all depend on free, open source software (FOSS) - that is a fact that we have to deal with in today's software industry. But can we be certain that no vulnerabilities or malicious code enter our products and development environment? Not really - but there are ways of increasing the security and integrity. Welcome to Saabs Software Supply Chain solution.
Speaker Bio
Mrs. Persson is a strong DevOps practitioner, bringing Development and Operations together in the critical supply chain of software for one of Saab's main software products. She works to introduce DevOps practices for teams and management in the organization and via education and training, tools and best practices implements the company DevOps goals.
The GDPR, the whole Schrems and nothing but the FISA 702
Since the beginning of 2018 things have changed drastically if you want to use cloud services from American companies. We got the CLOUD Act, GDPR, reports from eSam and the Schrems II judgement. Things are not exactly easy nowadays. And one thing hovers above all this, the FISA 702. Why did all this happen? What does different organizations do? Any open paths to go forward?
Speaker Bio
André Catry is a Senior Advisor in IT-/information security and cyber risk. André has more than 25 years of experience in advanced offensive and defensive cyber risk management. He has been doing assignments for the Swedish Defense Forces related to concept development on IT-försvarsförbandet (ITF). In addition, he has acted as a principal administrative director at the Swedish Security Service. André has several years of experience as a senior IT-security consultant and has worked on many high-profile cases and investigations. Furthermore, he has participated as a technical expert in eSams work on the conditions for authorities to use cloud services legally and appropriately. André is the author of the book Honungsapan.
Daniel Melin works with strategic issues around IT operations, datacenters and cloud services at the Swedish Tax Agency. Daniel has a governmental assignment to monitor ENISA's work with the cyber security certification for cloud services and also leads the governmental assignment to monitor the European project Gaia-X. Daniel has a background as a procurement officer at Kammarkollegiet and as a IT-consultant. Daniel was also the main researcher in the governmental study regarding a governmental cloud.
Cybersecurity Threat landscape and actions – views from critical functions for society and infrastructure
The high speed of digitalisation and new ways of working during the pandemic has brought new threats and highlighted the existing ones. Cyber attacks today affect organizations that are responsible for socially and infrastructurally critical functions globally. Thousands companies are affected today cross industry and authorities. We also see an increased and continued trend with 3rd party "supply chain" attacks that affects thousands of customers and companies. The increased threats have made companies more aware of the reasons for working actively with cyber security, which today is central in most companies' risk strategies. Which are the threats and risks? How should you think and act in the new threat landscape? You will learn more about the importance of adapting to a new age of technology and the challenges that arises with it. This presentation outlines the treat landscape for vital functions in the society, risks and potential actions.
Post-talk panel participants:
- Tony Kylberg (Head of Group Security & Cyber Defence at SEB)
- Ulf Larsson (Group Chief Security Architect at SEB)
- Kevin Aytap (CISO, Sveriges Riksbank)
- Ă…ke Holmgren (Director, head of Cybersecurity and secure communications department at the Swedish Civil Contingencies agency)
Moderated by Jonas Gudmunsson (Cparta Cyber Defense).
Speaker Bio
Tony Kylberg has a broad background and has hold positions as Lawyer at a Business Law Firm, Head of Legal Department and Head of a Sales Department within the finance industry, CEO of IT-Companies and of a Business Incubator and Partner/Investment Manager within a venture capital company. The last ten years he has been working as Head of Legal Baltic, Head of Procurement and CSO/CISO, Head of Group Security and Cyber Defence, within SEB.
GNSS security
Global navigation satellite systems (GNSS) have helped transform many sectors of economy and made our lives easier. Many applications obtain precise position and time provided by GNSS, with GNSS receivers embedded in a multitude of devices. Characteristic examples: smartphones, cars, telecommunication base-stations. However, the more we rely on GNSS the more likely it is that disruptions or attacks can deteriorate or disable services. With a lot of research towards making GNSS-based applications more resilient, the experts in this panel discuss the current state of affairs and future challenges.
Post-talk panel participants:
- Dr. Daniele Borio (Joint Research Centre of the European Commission)
- Dr. Beatrice Motella (ISMB, Torino)
- Prof. Erik G. Larsson (LiU)
- Dr. Gianluca Caparra (European Space Agency - ESA)
Moderated by Panagiotis Papadimitratos (Professor, Networked Systems Security (NSS) group, KTH).
Speaker Bio
Panos Papadimitratos earned his Ph.D. degree from Cornell University, Ithaca, NY. At KTH, Stockholm, Sweden, he leads the Networked Systems Security lab, and he is a member of the steering committee of the Security Link center. He has delivered numerous invited talks, keynotes, panel addresses, and tutorials in flagship conferences. He serves or served as: member of the PETS Advisory Board and the ACM WiSec and CANS conference steering committees; program chair for the ACM WiSec'16, TRUST'16, CANS'18 conferences; general chair for ACM WISec'18, PETS'19, and IEEE EuroS&P;'19; and Associate Editor of the IEEE TMC, the ACM/IEEE ToN and the IET IFS journals. He is a Fellow of the Young Academy of Europe, a Knut and Alice Wallenberg Academy Fellow, an IEEE Fellow, and an ACM Distinguished Member.
Moderator
Bio
Ann Molin is the founder and Secretary General of the Hack for Earth Foundation, hosting Hack for Earth at the upcoming world exhibition Expo2020 in Dubai in collaboration with the United Nations and the Swedish Pavilion at Expo2020. Hack for Earth is the biggest global online hackathon ever, where 10.000+ people from all over the world will create real solutions to the 17 UN Sustainable Development Goals. As a hackathon expert and former head of government mission Hack for Sweden, Ann has extensive knowledge in international innovation work and ecosystem building, with a strong focus on impact and building sustainable citizendriven innovation. Ann was nominated "Corona hero of the year" for organizing the global online hackathon Hack the Crisis Sweden, an event that gathered 7400+ participants from 90+ countries. Ann also organized Kids Hack the Crisis, a global online hackathon for children in collaboration with UNICEF in the fall of 2020, gathering children from 70+ countries to hack the Corona crisis effect on childrens lives.
2020
COVID-19 hit and Midnight Sun CTF moved from KTH to Posthuset.