Author Archives: user469294

Cyber Security Summer School 2018: “Maritime Cyber Security”

11-15 June 2018, Tallinn, ESTONIA, Estonian Maritime Academy

This year’s Cyber Security Summer School will focus on maritime cyber security. With experts from maritime sector, marine technology industries and cyber security establishments, the Summer School will give an overview of the tools and communications used in shipping industry, discuss their vulnerabilities and also introduce new trends in autonomous shipping and its dangers and risks.

Program
MONDAY, June 11th
8:00-9:00 Registration. Breakfast
09:00 Welcoming words and opening of Summer School by Organizers
10:00 Opening keynotes: TBD
12:00 Lunch
13:00 – 15:30 (room I) Track 1: Traditional maritime communication and navigation methods for Cyber Security Students (including GPS spoofing, Navigation messages, AIS etc).
13:00 – 15:30 (room II) Track 2: Ship Hacking Demo & introduction to cyber security for seafarers.
15:30 Coffee break
16:00 – 16:45 Practical exercises (e.g., HF call interception)
16:45 – 17:00 Feedback and closure for the first day

TUESDAY, June 12th
09:00 Breakfast
09:30 Modern methods – autonomous ship, sat voms, loT by D4V team
12:00 Lunch
13:00 Afternoon at Mektory joint event with Cyber Spike Competition. Tour in Mektory
14:00 Human factors & OSINT by Jenny Radcliffe & Lisa Forte
15:15 Panel Discussion on Maritime Cyber Security by Jeff Moulton and Jenny Radcliffe
16:00 Winners of CyberSpike and cake by Birgy Lorenz

WEDNESDAY, June 13th
09:00 Breakfast
A broader look at other sectors with experience:
09:30 Car hacking & forensics
10:15 Cyber Security in Aviation and joint efforts to secure the transportation industry from a regulator perspective by Gerry NGU EASA & European Centre for Cybersecurity in Aviation (ECCSA).
10:45 Coffee Break
11:00 Real-world malware stories by Anders Carlsson & Alex
12:00 Lunch
13:00 Political and cyber-warfare aspects of maritime cyber security by Joe Burton
14:30 Coffee break
15:00 Fake-GPS and Fake-Nav-chart attacks
15:30 TBD by Jeff Moulton
16:00 Practical exercise: cyber warfare exercise preparation by Mentors
19:00 Gala dinner

THURSDAY, June 14th
09: 00 Breakfast
09:30 Practical exercises in EMERA simulators
12:00 Lunch
13:00 Practical exercises in EMERA simulators
15:00 Coffee break
15:30 Practical exercises in EMERA simulators
16:30 Feedback and discussion by Organizers

FRIDAY, June 15th
09:00 Breakfast
09:30 Friendly student competition in EMERA simulators. Mentors
12:00 Lunch
13:00 – 14:00 Feedback and conclusions of the summer school by organizers

Links:
http://www.studyitin.ee/c3s2018/

ID card “The Lessons We Learned” conference

Leave a reply

Estonian Information System Authority (RIA) is organising an international conference on 9th of May in 2018 in Tallinn (Tallinn Creative Hub – Kultuurikatel) to discuss the impact and consequences of the security risk found in the Infineon chips in autumn 2017 by the researchers at Masaryk University in the Czech Republic.

The aim of this conference is to bring together parties affected by the security risk to discuss our lessons, experiences and responsibility, because the security flaw affected many companies and countries in Europe as well as elsewhere in the world. If possible, we aim to agree on a joint plan of follow-up activities or a memorandum to provide input to different authorities who establish regulative rules. Researchers from Masaryk University have announced their participation in the conference – they will make an opening presentation about their research.

The conference is aimed at policymakers as well as specialists in the eID field, opinion leaders, representatives of authorities and companies that are dependent on the functioning of Estonian ID-cards and e-services, developers of e-government and IT systems, and other parties related to the issue from both Estonia and Europe.

Agenda:
09.30-10.00 Delegate registration opens. Welcome coffee
10.00-11.30 Welcome and Opening of the Conference / Session 1
• Welcome by moderator Andres Kütt
• Welcome speech by the Prime Minister Jüri Ratas
• The goal of the research (ROCA vulnerability ) – Petr Svenda, the University of Masaryk
• The influence and the distinctness on Estonian ID-card and its use – Taimar Peterkop, the head of Information System Authority
• The examples of actions of different countries – Ulrich Latzenhofer, Austrian Regulatory Authority for Broadcasting and Telecommunications
11.30-12.00 Coffee break
12.00-13.30 Session 2
• Lessons we learned (Estonia) – Rain Ottis, Associate Professor at Tallinn University of Technology
• The contract of ID-card – who´s responsible of what? – Kaija Kirch, Police and Border Guard Board, ID expert
• Discussion How did we manage and what to do better next time? Expert panel lead by Rain Ottis. Attending: Kaija Kirch, Margus Arm, Ilmar Raag
13.30-14.30 Lunch
14.30-16.30 Session 3
• eIDAS perspective of the ROCA vulnerability – Security Expert and Information Security Officer, Marnix Dekker, ENISA
• Lessons we learned (global view) – Liisa Past, Chief research officer, Information System Authority
• Lessons we learned (Commission view) – Andrea Servida, European Commission
• Discussion What can we do better in the future? Expert panel lead by Liisa Past. Attending: Marnix Dekker, Andrea Servida, Ulrich Latzenhofer, Petr Svenda
• Conference conclusion by moderator Andres Kütt
16.30-17.30 Goodbye coffee and networking

Links:
https://lessonslearned.publicon.ee/conference-agenda/

Study on the lifecycle of cryptographic algorithms 2017

Leave a reply

This year we have ordered and will publish cryptographic algorithms life cycle report in parts. The first part is now available.

The first and the most important chapter gives overview of the current state of algorithms.

The second chapter writes about the cryptographic side of the last fall ID card crisis. The report describes what happened, what was done and how on the cryptographic side the new solution (elliptic curves) for ID cards works.

The third chapter gives overview of block-chain technologies and in addition provides Estonian-language terminology for block-chain related English terms.

The report has been ordered by RIA and written by Cybernetica researchers Ahto Buldas, Jan Willemson and Arne Ansper.

Links:
https://blog.ria.ee/ria-kruptouuring-id-kaart-ja-plokiahelad/
https://www.ria.ee/public/RIA/kruptograafiliste_algoritmide_elutsukli_uuring_2017.pdf
https://geenius.ee/uudis/nsa-usub-et-eesti-id-kaart-peaks-vastu-pidama-ka-kvantarvuti-runnakule/

Computational Law & Blockchain Festival 2018

Leave a reply

The first annual Computational Law & Blockchain Festival (#clbfest2018) is a three-day global event bringing together coders, designers, lawyers, policymakers, researchers, and students to co-create the future of law, legal practice, and policy. In the spirit of decentralization, the Festival will be hosted at independent, self-organized nodes in cities around the world.

DETAILED SCHEDULE (amended):

16 March 2018 @ Näituse 13a-201, Tartu

COFFEE OFFERED

10:15-11:45 TRACK LEARN
Electronic signature and enforceability of electronic contracts in civil law countries
Presentor: attorney Liisi Jürgen, NJORD Law Firm, lecturer of the IT Law Master´s programme

COFFEE BREAK

12:00-13:30 TRACK LEARN
Digital identities, e-residency and e-wallets – identity and digital footprint
Presentors: attorney Anne Veerpalu and attorney Liisi Jürgen, NJORD Law Firm, lecturers of the IT Law Master´s programme

13:30-15:00 TIME FOR A BREAK
(no lunch is offered by Legal Hackers)

15:00-15:45 TRACK LEARN
Decentralization and innovation ecology – what type of ecology is needed for legaltech to accelerate it innovation? Introducing many technologies which in themselves are not going to revolutionize everything.
Presentor: Michael Gallagher

COFFEE BREAK

16:00-17:30 SESSION 3: COMPUTERIZED LAW
Visualisation of law: An Automated Legal Content Capture and Visualisation Method (Automaatne meetod õigusteabe hankimiseks ja visualiseerimiseks)
Presentor: Ermo Täks, PhD (Computer Science, TTÜ)

17:30- 18:15 SESSION 3: INTRO TO SMART CONTRACTS (pre-recorded)
TBA
Presentor: Dr. Martin Ploom, who has worked for the last years for Man Investments, Credit Suisse and UBS in In-house Consulting / Project Management roles. He is an MBA, Dipl. Inf., Ms. Ec. and finished CFA Level III in 2010. He has been a crypto currencies enthusiast since Autumn 2012.

17 March 2018 @ Näituse 13a- 201, Tartu

COFFEE OFFERED

10:15-11:45 TRACK LEARN
Virtual currencies: legal and tax issues
Presentor: attorney Priit Lätt, PWC Legal, lecturer of the IT Law Master´s programme

11:45-13:00 TIME FOR A BREAK
(no lunch is offered by Legal Hackers)

13.00 – 13:30 INTRO TO HACK TRACK WILL TAKE PLACE @ Näituse 13A, TARTU

24h Hackaton – participants are welcomed to either listen to the next LEARN TRACK SESSION 3 or go to a separate location to work with their team
Hackaton location: J. Liivi 2 – 111, Institute of Computer Science, University of Tartu
Open from 1 pm on 17th March
Coffee break at 3 pm- 3.30 pm
Moderator: Stanislav Degtjarjov, Agrello.io

GLOBAL HACKATON registration available here:
https://docs.google.com/forms/d/e/1FAIpQLScQPaWitG8GKZ0xTdipHptwZlBeH9atPGjScI5768pRl5mC0w/viewform

LOCAL HACKATONS introduced at SESSION 2 and 1 pm on 17th March @ Näituse 13a, Tartu

13:30-16:00 TRACK LEARN/DISCUSS

SESSION 3: Blockchain Computing & Its Security Challenges

* Miao ZhiCheng, from decentral.ee, ex Skyper, ex. Twilion – “Blockchain computing vs. traditional computing – an overview”
* Dr. Marlon Dumas “Automating Business Processes With Smart Contracts”
* Agrello team : “Smart contracts technical standards”
* (recorded video) Dan Selman, from claus.io, “Accord Project – The Techno-Legal Standards”
* Risto Alas from Guardtime – “the DAO and the vulnerabilities discovered in Ethereum smart contracts”
* Taimo Peelo, “Ethereum Honeypots”
PANEL led by Miao ZhiCheng

16:15-16:45 TRACK LEARN
Tax issues at ICO and post-ICO
Presentor: attorney Elvira Tulvik, MAGNUSSON

Links:
https://www.meetup.com/Estonia-Legal-Hackers/events/247447020/

Estonian intelligence chief invites hackers to work

Leave a reply

The Estonian Foreign Intelligence Service (Välisluureamet) was previously known as the Estonian Information Board (Teabeamet).

This world is very fast and very good experts are required. Your homepage, which has become a little more informative recently, suggests that you are also looking for new people?
Of course we are looking. Do not we compete on the same market as other public authorities and the private sector? If we are talking about a big data or a better use of public sources in obtaining our information, then everyone with this competence is very much in demand.

At the end of the annual report (Estonian version), I found one challenge. These who can solve this could work for you?
Since we have a publication once a year, where we talk about our work openly, we also intended to use this publication to expand our recruiting field. If people reach to the last page of the document, then there may be some who can solve the puzzle and send the solution to us. I can not guarantee that the solution ensures a job, as other processes need to be followed. However, it definitely shows that the person has competence and analytical mind in cryptography.

You are giving interviews that would have been a big surprise many years ago. You reject the public myths about intelligence work. Your agency publishes puzzles to find potential employees. What is the future of your agency?
Yes, over the last few years, we have come out of the shadows and closer to the public. My clear view is that if you are not in the picture then you do not exist. However, if we want to recruit the best specialists, it is very difficult to find people for an institution that does not exist. Of course, we must at the same time be aware of security, but these risks can be handled. But in the future of intelligence, there are two keywords: co-operation and technology.

Crypto challenge:

Signal intelligence was able to capture an encrypted message: SDZROZDBITGNUMYNSF
However, the receiver was unable to decrypt the message and the message was transmitted again: YHDRCRLBUTIPUCMFGF

Questions:
(a) What was content of the message
(b) What key was used to encrypt

The solutions can be sent to info@valisluureamet.ee with topic “Nuputamisülesanne”

The crypto challenge seems just as a way to get attention. We are living in times where end-point exploitation is the tool to obtain intelligence. The capability to break ancient substitution cipher is unlikely to help.

Links:
https://geenius.ee/uudis/eesti-luurejuht-kutsub-toole-hakkereid-see-elus-ainulaadne-voimalus/
https://news.err.ee/681856/estonian-intelligence-chief-threat-of-direct-russian-military-attack-low
https://www.valisluureamet.ee/pdf/raport-2018-ENG-web.pdf
https://valisluureamet.ee/pdf/raport-2018-EST-web.pdf
https://news.postimees.ee/4404323/russia-looking-for-agents-of-influence-in-estonia

Cyber Security master’s theses defense in Tallinn University of Technology (January 2018)

Leave a reply

January 8th, 2018, Akadeemia Tee 15a, Room ICT-315.

Time: 10:00
Student: Silvia Väli
Title: Analysis of Electron-based applications to identify XSS flaws escalating to code execution in open-source applications
Supervisor: Olaf Manuel Maennel
Reviewer: Bernhards Blumbergs

Time: 10:40
Student: Juhan Kaalep
Title: The Status, Reasons And Perspective of Cyber Security of Estonian SME-s in the Context of the Cyber Essentials Scheme
Supervisor: Andro Kull
Reviewer: Tiia Sõmer

Time: 11:20
Student: Tiiu Mamers
Title: The Art and Science of Information Security Investments for Small Enterprises
Supervisor: Olaf Manuel Maennel
Reviewer: Andro Kull

ETV showed sensitive information on the screen

Leave a reply

On Tuesday, “Ringview” had the episode in which the reporter Jüri Muttika traveled around the editorial office of ERR and asked ETV TV presenters to demonstrate their handwriting. An embarrassing error by the video editors allowed the frame to be broadcasted, which contained “Terevisiooni” file transfer protocol (FTP) username and password, hence allowing everyone to view the content on the servers.

The clip shows that the TV presenters tried to hide their notebooks and computer screens from the camera, which makes it especially embarrassing – basically everyone was able to watch broadcast materials.

The error in ERR was quickly recognized and now the password should be changed. The topic is also up in Facebook IT-man’s group, where the IT people write jokingly: “No such user and password do not really hide anything.”

Wouldn’t we expect the ETV internal FTP server to be firewalled from the external world?

Links:
http://publik.delfi.ee/news/kino/sajandi-teleaps-ringvaade-naitas-ekraanil-tundlikku-siseinfot?id=80476232

State confiscates first criminally obtained bitcoins

1 Reply

The employees of the Criminal Police organized crime department in the summer arrested a young man living in Estonia who sold large amount of different drugs on the darkweb. With the help from the cybercrime unit of the Central Criminal Police, the bitcoins earned from the sale of drugs were also obtained, which, by the present moment, based on the county court order have been confiscated. The information about the amount of bitcoins sized is not available.

According to the Prosecutor General Vahur Verte, it is true that identifying the owner of the crypto money and tracking the movement of money is more complicated, but certainly not impossible.

How did the police technically size the bitcoins? Were they transfered to state-owned bitcoin wallet? Who paid for the transaction fees?

Links:
https://geenius.ee/uudis/eesti-riik-arestis-esimesed-kuritegelikul-teel-saadud-bitcoinid/

Passwords of 200’000 Estonian social media accounts leaked

Leave a reply

CERT Estonia, the organization responsible for the management of security incidents in .ee computer networks, informed nearly 200,000 Estonians via their employers that their social media passwords had been leaked. According to RIA, a database was created in Dark Web, containing 1.4 billion user information and a password in the open form. The database also contains email addresses with more than 190,000 ending in .ee.

For each institution, CERT sent a list of individual email addresses. “For example, if there were people from national broadcasting, let’s say mari.maasikas@err.ee, then we sent information to the head of ERR’s information security that the passwords of these people have leaked.” explained Mägi.

The number of Estonians at risk is much bigger, since most of the personal e-mail accounts are not using .ee domain. Some Good Samaritan could instead send out direct warning e-mails to all of the addresses in the database.

Links:
http://news.err.ee/648949/200-000-estonians-social-media-passwords-breached
https://geenius.ee/uudis/200-000-eestlase-sotsiaalmeedia-konto-murti-lahti/
https://www.ria.ee/ee/tumeveebis-avaldati-14-miljardi-kasutaja-paroolide-seas-ka-eesti-inimeste-paroolid.html
https://geenius.ee/uudis/eesti-kuberkaitsja-tegelikult-voib-eestist-lekkinud-paroole-olla-palju-rohkem-kui-200-000/
https://medium.com/4iqdelvedeep/1-4-billion-clear-text-credentials-discovered-in-a-single-database-3131d0a1ae14

Reproducing Android Vote Verification Application Builds for Estonian I-Voting System

Leave a reply

The main objective of this work is to check whether the vote verification applications distributed in the app stores can be compiled from the source code that has been made publicly available by Estonian National Electoral Committee. The experiments were performed using the Vote Verification application versions that were distributed in the I-voting period of the Estonian municipal council election held in October 2017.
The report will go through the different steps that were done during this experiment – monitoring the binaries, building the app from the source code, comparing build result with the distributed version and trying to reproduce it based on the differences found.

This is the report for UT course “Research Seminar in Cryptography (MTAT.07.022)”. The work deals with reproducible build problem of vote verification software used in Estonian i-voting held in October 2017.

The TL;DR; is that the source code available in GitHub is outdated and apparently was not the source code which was used to build the applications that were distributed to Android devices in Google Play Store.

Links:
https://courses.cs.ut.ee/MTAT.07.022/2017_fall/uploads/Main/annika-report-f17.pdf