APWG | eCrime 2023 Speaker Bios

APWG eCrime 2023 Speakers: Talk Abstracts – and Their Legends

Speaker’s bio: Chema Alonso is member of Telefonica S.A. Executive Committee from 2016 and he is currently Chief Digital Officer. In this role, he oversees Innovation, Data, Platforms and Digital Product & Services leading the strategy for the digitalisation of sales processes and customer communication channels of the company. As head of this Global Unit, he also aims to promote innovation of new digital products and services as well as the generation of internal efficiency supported by the technological capacities of big data and artificial intelligence of Telefónica’s fourth platform, with special focus on the digital home. With a long background in the area of innovation, he is also responsible for the innovation of Telefónica’s core technologies as well as the company’s relationship with the entrepreneurial ecosystem under an open cooperation model. Contact info: mypublicinbox.com/ChemaAlonso

Paul Vixie serves as VP and Distinguished Engineer at AWS Security, and is a Director at SIE Europe U.G. He was previously the founder and CEO of Farsight Security (2013-2021). In addition, he founded and operated the first anti-spam company (MAPS, 1996), the first non-profit Internet infrastructure software company (ISC, 1994), and the first neutral and commercial Internet exchange (PAIX, 1991). Vixie was inducted into the Internet Hall of Fame in 2014 for work related to DNS, and is a prolific author of open source Internet software including Cron and BIND, and of many Internet standards concerning DNS and DNSSEC. He was CTO at Abovenet/MFN (1999-2001) and worked at DEC Western Research Lab (1988-1993) after dropping out of school in 1980. Vixie earned his Ph.D. in Computer Science from Keio University in 2011.

Effective modern site security is behavioral in nature. We cannot choose or exclude our endpoints nor validate their supply chains, and so to the extent that we manage digital risks posed by our endpoints we do it by watching the signals (packets and flows) they emit. Such observations are categorically untenable for investigative journalists and dissidents since the category is occupied by corrupt or authoritarian regimes or their national security apparatus — as explained by E. Snowden in 2013 and as codified by the IETF in RFC 7258. — Using the same protocols for mobile devices which accounted for most human-centric endpoint growth since 2010 as we do for fixed devices on networks controlled by families and businesses is disrupting our limited ability to secure the latter in order to defend against worst-case outcomes for the former. Several decades of unapologetic abuse by the powerful have led the IETF to reform the basic Internet protocol suite around TLS 1.3 with Encrypted Client Hello, DNS over HTTPS, and the replacement of TCP by the UDP-based QUIC protocol. — In this new configuration, network operators will not be able to detect endpoint behavior changes corresponding to infection, takeover, poisoned software update, latent design dangers, predaceous grooming, insider corruption, or hundreds of other well-understood digital harms. Many such operators have not been warned about this “rules change” and deserve to have their expectations explicitly and immediately reset so that they can make new plans which will be practical in the next era. It is the goal of this presentation to enumerate those alarms.

L. Jean Camp is a Professor in the School of Informatics, Computing and Engineering at Indiana University, in Informatics and Computer Science. For 2019, she is at University of California at Berkeley as a Visiting Scholar at the Center for Long Term Cybersecurity. She is a Fellow of the Institute of Electrical and Electronic Engineers. She is a Fellow of the American Association for the Advancement of Science, and has been inducted into the Sigma Xi honor society.

She joined Indiana after eight years at Harvard’s Kennedy School where her courses were also listed in Harvard Law, Harvard Business, and the Engineering Systems Division of MIT. She spent the year after earning her doctorate
from Carnegie Mellon as a Senior Member of the Technical Staff at Sandia National Laboratories. She began her career as an engineer at Catawba Nuclear Station with a MSEE at University of North Carolina at Charlotte. Her research focuses on the intersection of human and technical trust, levering economic models and human-centered design to create safe, secure systems. She is the author of two monographs. In addition, she has authored more than one hundred fifty publications. She has peer-reviewed publications on security and privacy at every layer of the OSI model.

Phishing is a ubiquitous global problem that is both the simple crime of theft of authenticating information and the first step in advanced persistent attack chains. Despite receiving worldwide attention and investments in targeted anti-phishing campaigns, a large proportion of people are still vulnerable to phishing. This is not only due to the evolution of phishing attacks, but also due to the diversity of those exposed to phishing attacks in terms of demographics, jurisdiction, and technical expertise. To explore phishing resilience, we conducted a cross-national study to identify demographic and other factors that might have an impact on phishing resilience across nations. Specifically, we recruited 250 participants from the United States, Australia, New Zealand, Canada, and the United Kingdom to observe their responses to phishing websites in a simulated environment. We identified how factors including demographics, knowledge, skills, website familiarity, and self-reported risk assessment behaviors relate to efficacy in phishing detection. While participants’ phishing knowledge, familiarity with the target website, and their reported use of the lock icon as a phishing indicator increases participants’ probability of correctly identifying a legitimate website, we found that these factors did not specifically make them more resilient to phishing attacks. Our results further show that computer expertise has a significant positive impact on phishing resilience and that increased age correlates with the probability of misconstruing a phishing site as legitimate. These findings were applicable across all five countries in our study.

Dean S. Marks is a copyright and content protection attorney with expertise in the film and media industry. He served as in-house counsel for more than 25 years with Warner Bros. and Time Warner, most recently as Senior Vice President, Intellectual Property. He guided business practices with respect to copyright, digital rights management and content protection/anti-piracy issues and worked extensively on the introduction of the DVD and Blu-ray formats and protection measures for digital streaming of audiovisual content. He also worked on domestic and international copyright policy and legislation both in Time Warner’s European public policy office in Brussels from 1992 to 1995 and as a private sector adviser to the U.S. government delegation to the World Intellectual Property Organization (“WIPO”) Diplomatic Conference, which resulted in the adoption of the WIPO Internet Treaties in 1996. From 2015 to 2017,

He guided business practices with respect to copyright, digital rights management and content protection/anti-piracy issues and worked extensively on the introduction of the DVD and Blu-ray formats and protection measures for digital streaming of audiovisual content. He also worked on domestic and international copyright policy and legislation both in Time Warner’s European public policy office in Brussels from 1992 to 1995 and as a private sector adviser to the U.S. government delegation to the World Intellectual Property Organization (“WIPO”) Diplomatic Conference, which resulted in the adoption of the WIPO Internet Treaties in 1996. From 2015 to 2017, Dean was Executive Vice President, Deputy General Counsel and Chief, Global Content Protection for the Motion Picture Association, where he headed a global team to safeguard film and television content from all forms of piracy, particularly online piracy. From 2017 until 2022 Dean served as Executive Director and Legal Counsel for the Coalition for Online Accountability, that represents copyright interests at the Internet Corporation for Assigned Names and Numbers (“ICANN”) and in the Domain Name System (“DNS”). He was also a member of the initial Advisory Council of the DNS Abuse Institute. Dean has been appointed as an expert and conducted studies for WIPO’s Advisory Committee on Enforcement and various WIPO workshops. He has given testimony to Congressional committees and spoken at numerous conferences around the world. In addition, Dean teaches courses in various legal programs, including an advanced copyright course at the Munich Intellectual Property Law Center. Dean received his Bachelor of Arts degree in International Relations from Stanford University and his Juris Doctor from Yale Law School.

Given the ever-rising levels of cybercrime and online abuse, relying on law enforcement and technical tools is insufficient. Intermediaries and online infrastructure providers need to assume greater responsibility to confront and diminish this illegal activity. Policies such as Know Your Customer and responding to abuse complaints are examples of reasonable business practices that should be adopted by all internet intermediaries and online infrastructure providers. Many such intermediaries and providers, however, decline to adopt such responsible and reasonable practices. Bringing lawsuits and filing legal claims constitute an important path for pushing intermediaries and infrastructure providers to act more responsibly and to take on warranted duties in the fight against cybercrime. This presentation will examine a number of such lawsuits and court judgments in both the EU and the USA.

Gary Warner is the Director of Threat Intelligence for DarkTower, an intelligence company, and the Director of the Computer Forensics Research Lab at the University of Alabama at Birmingham. After spending twenty years in industry, culminating as an IT Director at Energen Corporation, Warner came to UAB in 2007 where he was instrumental in creating UAB’s Digital Forensics academic program. Warner has 35 academic publications related to cybercrime investigations and forensics, including the Journal of Digital Forensics Security and Law, the International Journal of Multimedia Data Engineering, and the International Journal of Digital Crime and Forensics. Warner is a frequent conference speaker, having presented at more than 230 conferences on a variety of topics including malware, cybercrime investigations, and terrorism.

Cyber crime continues to evolve from the earliest days of the APWG, when online banking was in its infancy. Today criminals are crafting their attacks to avoid natural predators. When you attack a bank, the bank fights back. But who fights for the romance scam victim? For the crypto investment scam victim? Ransomware has created the cyber insurance industry, but that doesn’t help the pensioner, the lonely widow, or the crypto believer who have lost everything. When fighting cybercrime doesn’t maximize shareholder profits, who will stand up and fight anyway?

Alexander Seger has been with the Council of Europe (Strasbourg, France) since 1999. He is Head of the Cybercrime Division and in that function he is the Executive Secretary of the Cybercrime Convention Committee in Strasbourg as well as Head of the Cybercrime Programme Office of the Council of Europe in Bucharest, Romania (www.coe.int/cybercrime). Prior to this he headed for many years the Economic Crime Division where he was responsible for the Council of Europe’s cooperation programmes against, corruption, organised crime, cybercrime and money laundering. From 1989 to 1998 he was with what now is the United Nations Office on Drugs and Crime in Vienna (Austria), Laos, Pakistan and Afghanistan, and a consultant for German Technical Cooperation (GTZ) in drug control matters. Alexander Seger is from Germany and holds a PhD in political science, law and social anthropology after studies in Heidelberg, Bordeaux and Bonn.

In February 2022, the United Nations commenced – through an Ad Hoc Committee (AHC) – the preparation of a UN treaty on “the use of information and communication technologies for criminal purposes”. Following six sessions so far, the negotiations are in principle to be concluded in February 2024. The process had been initiated by the Russian Federation with the intention to replace the Budapest Convention on Cybercrime. This presentation will (a) provide an update on the process, (b) explain the issues at stake, and (c) discuss links between a possible additional UN treaty and the framework of the Budapest Convention.

Brad Wardman (PhD in Computer and Information Systems) is the Head of Threat Intelligence for Booz Allen Hamilton Commercial where he is leading the program to meet the current threat environment by engaging in proactive threat research, building and assessing Cyber Threat Intelligence (CTI) programs, and developing customized intelligence services depending on client needs. Before arriving at Booz Allen Hamilton, Brad was responsible for a number of functions at PayPal including Enterprise Threat Management, Product & Customer Threat Management, Threat Intelligence & Engineering, and Insider Fraud. Brad resides on the Board of Directors for the Anti-Phishing Working Group (APWG) and serves as the Co-Program Principal Investigator for the PhishFarm Blacklist Latency Monitoring Initiative. He specializes in detecting, tracking, and fighting cybercrime and financial crime employing data-driven approaches.

Phishing is less understood today than it was 10 years ago. TTPs have evolved, and we are behind as an industry in stopping the attacks as well as understanding the impact of these attacks. Phishing a regularly accepted risk by organizations, who provide minimal funding and resources focusing on phishing TTPs. Yet, phishing accounts for estimated half of all initial access for ransomware campaigns, primary delivery mechanism for business email compromise (or BEC) scams, and the number of attacks continues to exceed all time highs. This talk will provide attendees with research directions that the APWG would like to explore with industry and academic communities. Research directions include gaining a deeper understanding of what phishers are targeting within different industries, identify and track phishing related TTPs, and measure the effectiveness of the ecosystem’s controls against phishing related TTPs.

Dr. Sanchari Das is an Assistant Professor in the Department of Computer Science at the Ritchie School of Engineering and Computer Science, University of Denver. She leads the Inclusive Security and Privacy-focused Innovative Research in Information Technology (InSPIRIT) and Secure Realities Labs, focusing on computer security, privacy, human-computer interaction, accessibility, and the sustainability of emerging technologies. – Dr. Das received her Ph.D. from Indiana University Bloomington, with a dissertation on users’ risk mental models in authentication technologies. She holds a Masters in Security Informatics from Indiana University Bloomington, a Masters in Computer Applications from Jadavpur University, and a Bachelors in Computer Applications from The Heritage Academy. – Beyond academia, she served as a User Experience Consultant at Parity Technology, as a Global Privacy Adviser at XRSI.org and has gained industry experience at American Express, Infosys Technologies, and HCL Technologies. Her work, published in top-tier academic venues such as CHI, FC, and SOUPS, has also been presented at prominent security conferences, including BlackHat and RSA, and received media coverage in outlets like CNET and PC Magazine. In her teaching and research, Dr. Das is committed to shaping the next generation of security professionals and to creating secure, user-centered systems.

With more than 35 years of experience in technology and cybersecurity, Shawn Loveland has worked for both large and small companies. He has also been awarded 15 US patents and numerous international ones in various fields including computer security and telephony. – At Resecurity, Shawn is the COO and leads the efforts to help our clients handle the current threat landscape effectively. This involves conducting proactive threat research and assisting our customers in assessing Cyber Threat Intelligence (CTI) programs. Additionally, he customizes intelligence services to meet their individual needs. Before joining Resecurity, Shawn oversaw dark web intelligence at Microsoft.

In this discussion, we will discuss the expected evolution of phishing attacks — and suggest ways for defenders to combat them. The world of cybercrime is constantly changing to adapt to new defense strategies and capabilities provided to cybercriminals through their supply chain. While technology helps those defending against cybercrime, it also gives power to criminals.

Mr. Nakajima will be presenting on recent phishing cases in Japan in which he will examine the scourge of Fake Stores, phishing and other important kinds of cybercrime in Japan.

Luis Corrons Head Shot — **Luis Corrons**

Luis boasts a distinguished career in the security industry that spans decades, with a specialized focus on the anti-virus domain. Currently serving as the Security Evangelist for GEN (Avast, AVG, Avira, and Norton), Luis’ expertise is widely recognized. As Chairman of the Board of Directors for AMTSO (the Anti-Malware Testing Standards Organization) and a board member for MUTE (Malicious URLs Tracking and Exchange), Luis’ leadership has been instrumental in shaping the landscape of cybersecurity. A passionate orator, Luis has graced the stages of premier industry events such as Virus Bulletin, HackInTheBox, APWG, AVAR, and Security BSides, captivating audiences with insightful perspectives.

As the digital frontier evolves, so do the weapons of cyber adversaries. This talk will delve into the transformative impact of cheap or free generative AI on the capabilities of phishers and scammers. We’ll explore how this advanced technology has become a boon for malicious actors, empowering them to craft more convincing, adaptive, and wide-reaching campaigns than ever before. But it’s not just the cybercriminals who are harnessing the power of AI. In response, defenders are innovating and adapting, leveraging similar technologies to detect and counteract these enhanced threats. This presentation will set the stage for understanding the present landscape of AI-augmented phishing, laying a foundation for a subsequent exploration into the future challenges and opportunities that this technology presents.

Greg Aaron is President of Illumintel Inc. He is an internationally recognized authority on cybercrime and the Internet’s domain name system. He has performed investigations with industry, law enforcement, and security researchers to address phishing, malware, spam, botnet, and intellectual property cases. Greg is Senior Research Fellow for the APWG, where he is the editor of the APWG’s quarterly phishing reports, and manages the APWG’s eCrime Exchange. As a member of ICANN’s Security and Stability Advisory Committee (SSAC), Greg advises the international community regarding the DNS. He is also a licensed private detective. Greg is a magna cum laude graduate of the University of Pennsylvania.

Greg Aaron is a co-author of “Phishing Landscape 2023: An Annual Study of the Scope and Distribution of Phishing.” Based on millions of phishing reports from the last year, this magisterial paper analyzes the growth of phishing, and how and where it’s happening. Greg will provide not only the stats, but insights into why phishing continues to flourish, and what’s needed to move the needle: new policy regimes, new laws, and new strategies to prevent phishers from obtaining the resources they need for their criminal activities.

Aimée Larsen Kirkpatrick is the President and Co-Founder of the STOP. THINK. CONNECT. Messaging Convention. Ms. Larsen Kirkpatrick has spent the last 20 years in communication and public affairs developing campaigns and programs to educate and change people’s behavior on a variety of topics ranging including technology use, public health, and environmental issues. She has spent the last 15 years focused on cybersecurity communication executive, leading campaigns to raise awareness and teach people how to better secure their digital assets and practice cyber hygiene, most recently with the Global Cyber Alliance as the Global Communication Officer. Ms. Larsen Kirkpatrick was instrumental in the founding of the STOP. THINK. CONNECT. campaign (an international public service campaign to educate the public on cybersecurity and internet safety) while she was with the National Cyber Security Alliance (NCSA) where she served as the Partnership Engagement and Strategic Initiatives Director. Ms. Larsen Kirkpatrick was a 2012 Executive Women’s Forum Women of Influence Award recipient. She also serves as a Senior Research Fellow for the Anti-Phishing Working Group (APWG) and advises on their public education initiatives.

PANEL: Bridging the Digital Divide: Empowering Users through Research-Based Awareness Instrumentation

Robert Flaim is Head of Strategic Programs | IP & DNS Team at Meta. Mr. Flaim joined Meta as the head of strategic platforms in June 2020. Previously, Mr. Flaim was business development manager for Amazon Web Services, after leaving the FBI where he was a strategic technology advisor for more than 20 years. – Robert Flaim entered the FBI as a Special Agent in 1997 after serving several years as a US Army Judge Advocate General Officer. He has been assigned to the Washington DC Field Office since then and has worked primarily cyber issues. – From 1999 onward, then Special Agent Flaim was assigned to the FBI’s Cyber Division (formerly part of the US National Infrastructure Protection Center), where he investigated computer intrusion matters in both the criminal and national security areas. As the focus of the FBI’s cyber mission had changed since 9/11, Special Agent Flaim participated in several investigations of international cyber-terrorism and cyber-intelligence. – Mr. Flaim during his FBI tenure, worked with a number of global IT companies in the Washington DC and Northern Virginia area, as well as ICANN, regional, national and international law enforcement agencies on numerous cases involving IT security and privacy.

Stephen Cobb

Stephen Cobb is an award-winning technologist who has spent over four decades working and researching at the intersection of digital technology and human behavior. The author of multiple publications on cybersecurity and data privacy, he is a CISSP (1996), and holds a masters in security and risk management from the University of Leicester (2016).

Cyberspace as an unhealthy high crime neighborhood

Challenges to a Global Response to Cybercrime Posed by Complexity of Attack & Obfuscation Architectures

It is well known that the digital world is constantly in flux. Cybercriminals are constantly changing and evolving their schemes alongside economic and other incentives, while technical innovations and improvements like AI/ML constantly redefine the playing field. Besides profit-oriented actors, state-sponsored and political actors are ever more involved in attacks on organizations and state institutions worldwide.

While the threat landscape’s only constant is its challenging nature, the politics, laws, and policies that impact on online abuse are constantly rethought, redefined, and renegotiated. These policy changes matter a lot to defenders and blue teamers, who have to contend with the evolution of their adversaries and the tools they have at their disposal, all while they are also impacted by technical change.

This panel will focus on all these developments and the resulting complexities. In short, how can we understand and crucially, address the co-evolution of all these issues and factors, be this at a national, international or organizational level?

Drawing from the expertise of our panelists, we will try to better grasp each area, i.e. criminal evolution, relevant technical changes, the evolution of anti-abuse, and the ever-changing nature of politics and policy. In discussion with each other, and the audience, the panelists will attempt the difficult task to establish a better understanding of how these areas affect each other, and what outcomes we are likely to see but also provide policy options.

Panelists:

Dr. Laurin Weissinger, Fresenius Digital Technology / Department of Computer Science, Tufts University / Yale Law School
Richard Clayton, University of Cambridge
Miranda Bruce, University of Oxford
Brad Wardman, Booz Allen Hamilton / APWG
Dr. Serge Droz, Swiss Federal Department of Foreign Affairs / Vice Chair, FIRST
Stephen Cobb, Independent Researcher

Anil Raghuvanshi Potrait — **Anil Raghuvanshi**

Anil Raghuvanshi is the founder/president of ChildSafeNet, a leading organization in Nepal working to protect children and young people online. He had worked for more than three decades in nine countries as a child protection professional, with Unicef, ILO, UN DPKO, Save the Children, ECPAT International and Plan International. – He has been promoting a safer and better internet for children and has started the Safer Internet Day campaign and STOP.THINK.CONNECT. movement in Nepal. – He has led a number of research studies on protecting children online and is a member of the Global Advisory Group of Sexual Violence Research Initiative.

Patrick Cain is the President of the Cooper-Cain Group, Inc, a Boston, US security consultancy. He has over 30 years of experiences in information security, including leading the effort on the first FIPS-140 Level-3 cryptographic peripheral in 1998. In his free time, he is The Resident Research Fellow and Board member of the Anti-Phishing Working Group (apwg.org) where he discovers novel ways to do e-crime data collection and sharing. Mr. Cain holds the Certified Information Systems Auditor (CISA) and manager (CISM) certifications, is a member of the International Association of Privacy Professionals and spends lots of time with lawyers.

The latest version of the APWG’s e-Crime Exchange (eCX) has been in heavy use since 2016. That’s a long time in Internet-years. This presentation summarizes what we’re updating in the architecture and API, additional new member-requested features, some planned future additions, and expansion into new data sets to make it more member useful and helping it to flourish in the next Internet age – and meet whatever grim challenges cybercrime may hurl into the path of APWG’s intrepid members. And we’ll show it off;

Righard Zwienenerg — **Righard Zwienenberg**

Righard Zwienenberg started dealing with computer viruses in 1988 after encountering the first virus problems. His interest thus kindled he has studied virus behaviour and presented solutions and detection schemes ever since. Starting as an independent consultant, later as R&D Manager at CSE Ltd, as a researcher for ThunderBYTE, as Chief Research Officer at Norman, and currently as Senior Research Fellow at ESET. Over the years he has served in many extra roles in different industry organizations. Currently he is still serving on the board of AVAR, on the Technical Overview Board of the WildList and as the Vice Chair of the Executive Committee of IEEE ICSG. In 2018, Zwienenberg joined the Europol European Cyber Crime Center (EC3) Advisory Group as an ESET representative. Zwienenberg has been a member of CARO since late 1991. He is a frequent speaker at conferences – among these Virus Bulletin, EICAR, AVAR, RSA, InfoSec, SANS, CFET, ISOI, SANS Security Summits, IP Expo, Government Symposia, SCADA seminars – and general security seminars.

ChatGPT is the buzzword of the year. Suddenly everyone mentions and everything uses ChatGPT (or so they say). But many people do not know what ChatGPT really stands for, or what it really is! Many people do not even know ChatGPT is just an example of a Large Language Model (LLM) bundled with some Machine Learning (ML) module and that there are many others in existence. To get a good overview of the progress in LLM technology, we will dig into the short history of LLMs. There is no doubt about that LLMs can be a great asset for your company’s workflow. But at the same time, you should wonder: can an LLM expose your company secrets? The answer is plain and simple: YES! (And it already happened.) Leaving aside the good things an LLM can be for your company, we will focus on the dangers lurking around the use of an LLM and/or AI and your company depending on it, and showing real-life examples where it went or can go wrong, e.g., with Identity Management, Marketing, PII, (False) Information gathering, creation of (unethical) content, etc. Of course, LLM and ML failures can lead to some humorous moments too; several of these will be showcased during the presentation. We will conclude with what you can do to safeguard your company and yourself against all the nasty elements that may occur when using LLMs

Eddy Willems is a known malware expert from Belgium. He is a board member of 3 security industry organizations, EICAR, AVAR and LSEC, and is the resident Security Evangelist and Global Security Officer at G DATA Cyberdefense. He became a founding member of EICAR in 1991, one of the world’s first security IT organizations. Over the years he has served in many extra roles in different security industry organizations. Several CERTs, press agencies, print and online publications and broadcasting media, for example CNN, use his advice regularly. In October of 2013, he published his first book in Belgium and the Netherlands, entitled Cybergevaar (Lannoo). In December 2015 he published a translated version of his book entitled Cybergefahr (Springer) in the German-speaking countries. An English translation and update, Cyberdanger (Springer), was published in 2019. Eddy is a known inspiring speaker and is giving lectures and presentations worldwide for a very wide audience from children to experts.

Pedro Janices has been National Director of Critical Information Infrastructure and Cybersecurity and Director of the National Office of Information Technologies, both at the National Cabinet of Ministers. He has worked for more than 25 years in the National State.

Josep Albors is the Head of Awareness & Research at ESET Spain. He has more than 17 years’ experience in cybersecurity and now specializes in security awareness. He is also the editor at the ESET Spain blog and one of the contributors to the international ESET blog WeLiveSecurity. He participated as a speaker at the AVAR 2019 international conference, and at many important local security conferences in Spain. Josep is a teacher in cybersecurity courses at several Spanish universities. He collaborates with the Spanish Guardia Civil, Spanish National Police and the Spanish Army, and teaches their units how to fight cybercrime.

No, this abstract is not about some energy drink: it is all about the experience of encountering a life-threatening emergency. Energy: its availability is something we all take for granted and are highly dependent on; hence its generation and distribution is part of a nation’s Critical Infrastructure (CI).
Understandable that, in modern warfare, nation-states or APT groups (try to) attack their opponent’s CI, including the energy sector. Remember BlackEnergy or Industroyer, where the energy system fell victim to cyberattacks?
An energy system does not have to fall victim to a cyberattack to stop producing energy. We have the sad examples of the nuclear reactors at Fukushima after a natural disaster, as well as the Zaporizhzhia Nuclear Power Plant in Ukraine, where we still are in fear because of the ongoing war.
With the ever-increasing price of energy, many homes now are equipped with solar panels. Besides cost reduction, they also make the building’s occupants less dependent on the power grid. These solar panels can also return the generated but unused electricity to the power grid. Since almost all houses that have solar panels are smart homes, the panels are connected, and it can be fun to see the daily savings in an app.
Worldwide, power grids are mostly old and cannot handle too much generated power put back into the net. An overload causing cables to melt can be the result. To prevent this, the power companies usually can either not take your generated electricity or shut down one or more of your solar panels. And that, without you knowing it, is costing you money. Nevertheless, it is understandable, as melted electricity supply cables are not something we want. But if the power company can shut down your solar panels remotely, so can someone else when they figure out how to do that!!!
Due to environmental concerns, by 2030 in the European Union, all new cars sold must be zero-emissions, and many people are already switching to electric vehicles. The future traffic jams will be at the charging stations. But the charging stations are the next problem. For mobility we will be 100% dependent on (again) electricity. Not only can we paralyze a country by shutting down a power system, but we can paralyze it further when most cars are electric, and more so if all cars are electric, including service vehicles of the police, firefighters, and paramedics…
Critical Infrastructure always needs to be protected against attacks. However, what happens if an attack is successful? Now we depend on and are spending so much more on “energy”; are we willingly increasing the problems if such an attack is successful?
In this presentation we will investigate potential attacks against the energy sector, the problems around solar panels and attacks against hybrid cars, and hacking and physical damage to electric car chargers done by a cyberattack. We will present real-life scenarios where these attacks can affect our daily life and even threaten not just our cars and houses, but also all the smart buildings under construction around the world.

Joao Santos is a distinguished lead investigator at Human Security on the Satori team. With over a decade of specialized experience in security, he has mastered roles from reverse engineering to penetration testing. Joao’s background as a sysadmin, coupled with his hacker mindset, fuels his passion for electronics and his admiration for Golang. His impressive track record extends to conducting threat research and audits for prominent enterprises and government entities in vital areas like passports and citizen IDs. Driven by his dedication to cybersecurity, Joao tirelessly shields individuals and organizations from potential cyber threats. A recognized voice in the community, he frequently shares his insights at information security conferences, championing a safer digital landscape for all.

This presentation delves into the recent disruption of the BADBOX fraud scheme by Human Security’s Threat Intelligence team Satori. BADBOX is a sophisticated fraud scheme involving a global network of devices fitted with pre-installed firmware backdoors. This supply-chain attack allows the perpetrators to commit various types of fraud. For example, imagine a scenario where your device is vulnerable to hacking and arrives pre-infected with malware, primed for fraudulent activities. With BADBOX, the Triada malware is a backdoor that enables fraudsters to control compromised devices remotely. This attack is delivered and hidden in residential and government networks around the world. The speakers will explore the technical aspects of the research, the different types of fraud, supplemental fraud modules from the operation known as PeachBox, pre-infected devices, and the ongoing efforts to disrupt this complex fraud scheme. Specifically, they will discuss: • The technical details of the BADBOX attack • The different types of fraud that BADBOX can be used to commit • The supplemental fraud modules used in the PeachBox operation • The methods used to deliver and hide the BADBOX attack • The ongoing efforts to disrupt the BADBOX fraud scheme • This presentation is essential for anyone who wants to understand the latest threats posed by BADBOX and how to protect themselves from this sophisticated fraud scheme

Gavin Reid serves as CISO for HUMAN Security. Gavin began his cybersecurity career in information security at NASA’s Johnson Space Centre. Later, he moved on to create Cisco’s Security Incident Response Team (CSIRT), Cisco’s Threat Research and Communications (TRAC), and Fidelity’s Cyber Information Group (CIG). Before joining HUMAN to lead the Satori Threat Intelligence and Research Team as VP of Threat Intelligence, Gavin was the CSO for Recorded Future where he was responsible for ensuring the protection, integrity, confidentiality and availability of all customer-facing services, internal operational systems and related information assets. For more than 20 years, Gavin has managed every aspect of security for large enterprises.

Miranda Bruce is a Postdoctoral Fellow at the Department of Sociology. She contributes to the CrimGov project, exploring the sociological and geographical elements of cybercrime. Her past research focused on the Internet of Things and its social implications, especially the use of social theory to rethink how humans and machines are connected. She was the lead editor of the collection ‘Social Beings, Future Belongings’ for Routledge, and has developed and convened several advanced university level courses

Challenges to a Global Response to Cybercrime Posed by Complexity of Attack & Obfuscation Architectures

Panelists:

Dr. Benenson holds a permanent senior research position at the University of Erlangen-Nuremberg, at the Lab for IT Security Infrastructures, where she leads the “Human Factors in Security and Privacy” Group. Dr. Benenson’s current research interests include:

– Human factors in security and privacy (mental models, decision making, usability)

– Security and privacy in pervasive computing (IoT, cyber-physical systems)

Dr. Benenson’s take on the panel topic:

People are overwhelmed by the increasingly intelligent and inconspicuous methods of gaining illegal access to systems. However, security awareness is only a small part of the solution. Instead of trying to teach people “correct” and “secure” behavior, IT systems should be adapted to better accommodate human needs, perceptions and behavior.

Samaila Atsen Bako is a cybersecurity professional with over seven years of experience in protecting the digital assets of organisations within and outside Nigeria. He serves as the Director of Communication at the Cyber Security Experts Association of Nigeria (CSEAN) – the largest body of Nigerian cybersecurity professionals. He is the Security Strategist at Code for Africa (CfA) – Africa’s largest network of indigenous African civic technology and investigative data journalism laboratories.
Samaila holds an MSc cybersecurity and management from the University of Warwick, and multiple certifications including ISO27001 Lead Implementer, Computer Hacking Forensic Investigator, Certified in Cybersecurity, and so on. He was listed as an IFSEC Global Influencer in Security 2022, under the cybersecurity professionals category. He regularly speaks at events across the globe, mentors cybersecurity newbies in Nigeria and the United States, and volunteers in multiple non-profit initiatives including Cybersecurity awareness campaigns by CSEAN and CyberGirls Fellowship by CyberSafe Foundation.

Pablo López-Aguilar is the Associate Director of the Internet Integrity Program at Global Cyber Alliance (GCA). The GCA’s Internet Integrity Program aims to bring together key players in Internet infrastructure operations, including Internet ecosystem institutions, network operator groups, and ISPs and other infrastructure operators, as well as adjacent industries. Together they identify top priorities for addressing cybersecurity issues that cannot be solved by any single actor or subset of actors independently.

Prior to this, Mr. López-Aguilar worked as a Director of Technology at the Anti-Phishing Working Group and was involved in several research projects aiming to achieve high-quality results, cover a clearly demanded need and generate a permanent impact. He also founded a company, RespondOn, awarded with the “Award for Business Achievement and Capacity” given by the Banc Sabadell Foundation. Pablo is a Telecommunication Engineer from Universitat Pompeu Fabra, holds an MSc in Cybersecurity Management from Universitat Politècnica de Catalunya, and is a predoctoral researcher in the Department of Computer Engineering and Mathematics at the Universitat Rovira i Virgili in Tarragona, Spain.

Bringing a unique level of experience and scientific validation to her work, Dr. Abbie Maroño is both a scientist and a practitioner in the field of human behavior. Having completed her PhD in Psychology and Behavior analysis, Abbie became a Professor of Psychology at academic institutions by the age of 23, and specializes in nonverbal communication, trust, and the psychological mechanisms underpinning human decision making.

In 2022, Abbie was awarded an O-1 visa for extraordinary abilities in the sciences. As such, the United States Department of State recognized Dr. Abbie’s international acclaim and record of extraordinary achievements in the sciences as placing her in the top 1% of her field. Abbie is now the Director of Education at Social-engineer, LLC,
Abbie is an active member of several internationally recognized research groups and was awarded reviewer of the year in 2020, from select journals, for her significant contribution to the academic community. Abbie also provides expert advisement for academic institutions and the private sector.

Despite vishing being a dangerous and pervasive social engineering attack vector, very little is empirically nor operationally known about vulnerability factors, based on first-hand data. This is addressed in this State of Vishing report. In this State of Vishing report, we first examine the threat landscape and analyse data from 83,053 vishing calls carried out first-hand by our team, to identify vulnerability factors and data compromise rates. Vulnerability factors included demographic characteristics of both the caller and target, the interaction between caller and target characteristics, as well as the time of day the call occurred. Finally, we address the lack of operational and academic understanding in regard to Vishing and discuss ways to improve data security. The current report is the first industry report focused on human-to-human vishing data to date.

Richard Clayton is a software developer by trade, but returned to the University of Cambridge in 2000 to study for a PhD. He remained an academic because “it was more fun than working” and was the founding Director of the Cambridge Cybercrime Centre which collects and shares data on cybercrime with other academics. He has been dealing with abuse and crime for 30 years and has recently been collaborating on a series of papers which try to counter the myths surrounding cybercriminals, proposing that they are seldom sophisticated, that their skills are entrepreneurial rather than technical — and that they often find their chosen career to be extremely boring.

Challenges to a Global Response to Cybercrime Posed by Complexity of Attack & Obfuscation Architectures

Panelists:

Laurin B. Weissinger teaches at the Fletcher School, Tufts University, focusing on socio-technical cyber security. He is also the Cybersecurity Fellow and an ISP Visiting Fellow at Yale Law School.
Laurin studies and teaches cybersecurity from a holistic socio-technological perspective and utilizes multidisciplinary methods to explore the technical, social, and political aspects of cybersecurity in practice, as well as global cyber governance.
His research focuses on the problem of trust assurance in cyber security, (cyber) security threats more generally, cooperation in international and organizational cybersecurity, risk analysis, security policy, as well as cybercrime and anti-abuse.
Additionally, Laurin has international cybersecurity policy experience, having served as a Vice-Chair for the Second Security, Stability, and Resiliency Review for ICANN, the International Corporation for Assigned Names and Numbers (Final Report, January 2021).
Laurin’s research and policy work are informed by his fifteen years working in IT as a systems administrator and architect in the healthcare industry, as well as in technology consulting.
In terms of research methodology, Laurin has considerable experience in (expert) interviewing; policy and technical analysis; as well as quantitative data analysis, particularly network analysis and statistics. Having collected primary data for all his research, he is also experienced in organizing and conducting data collection in the field. He serves as a guest editor for a special issue on data collection for the Social Networks Journal.
Laurin received his DPhil (PhD) from University of Oxford, where he conducted an in-depth study of trust assurance in cybersecurity. Additionally, Laurin holds an MSc from Oxford, an MPhil from the University of Cambridge, and a BA from University of Birmingham. Laurin is a Certified Information Systems Security Professional (CISSP).

Challenges to a Global Response to Cybercrime Posed by Complexity of Attack & Obfuscation Architectures

Panelists:

Serge Droz is a senior IT-Security expert and seasoned incident
responder. Today he works as a senior advisor at the Swiss federal department of foreign affairs.
He studied physics at ETH Zurich and the University of Alberta, Canada and holds a PhD in theoretical astrophysics. He has worked in private industry and academia in Switzerland and Canada in different security roles, at a national CERT in Switzerland for more than 20 years.

Serge is a member of the board of directors of FIRST (Forum for Incident
Response and Security Teams), the premier organisation of recognised global leaders in incident response. In this role he actively participates in discussion relating to cyber security at various policy bodies, in particular related to norm building.

Challenges to a Global Response to Cybercrime Posed by Complexity of Attack & Obfuscation Architectures
It is well known that the digital world is constantly in flux. Cybercriminals are constantly changing and evolving their schemes alongside economic and other incentives, while technical innovations and improvements like AI/ML constantly redefine the playing field. Besides profit-oriented actors, state-sponsored and political actors are ever more involved in attacks on organizations and state institutions worldwide.
While the threat landscape’s only constant is its challenging nature, the politics, laws, and policies that impact on online abuse are constantly rethought, redefined, and renegotiated. These policy changes matter a lot to defenders and blue teamers, who have to contend with the evolution of their adversaries and the tools they have at their disposal, all while they are also impacted by technical change.
This panel will focus on all these developments and the resulting complexities. In short, how can we understand and crucially, address the co-evolution of all these issues and factors, be this at a national, international or organizational level?
Drawing from the expertise of our panelists, we will try to better grasp each area, i.e. criminal evolution, relevant technical changes, the evolution of anti-abuse, and the ever-changing nature of politics and policy. In discussion with each other, and the audience, the panelists will attempt the difficult task to establish a better understanding of how these areas affect each other, and what outcomes we are likely to see but also provide policy options.
Panelists:
Dr. Laurin Weissinger, Fresenius Digital Technology / Department of Computer Science, Tufts University / Yale Law School
Richard Clayton, University of Cambridge
Miranda Bruce, University of Oxford
Brad Wardman, Booz Allen Hamilton / APWG
Dr. Serge Droz, Swiss Federal Department of Foreign Affairs / Vice Chair, FIRST
Stephen Cobb, Independent Researcher

More than 10 years of experience in cybersecurity, currently focused on malware analysis research, reverse engineering and threat intelligence. Previously he carried out his duties within an anti-fraud team, providing services to different financial institutions, governments and CERT / CSIRT teams.
He is a regular collaborator in the community and speaker at national and international conferences. As part of his professional activity, he is also coordinator of the Master of Computer Security at “La Salle Barcelona”

Abtract: Prilex Unleashed: The Evolution of Brazil’s Most Notorious Cybercriminal Group: Prilex, a cyber threat enty with Brazilian roots, has transformed its inial strategy focused on malware for ATMs, developing a sophisticated modular variant of malware for Point of Sale (PoS) systems. In 2016, they orchestrated one of the largest ATM heists in Brazil, compromising more than 1,000 machines and duplicating more than 28,000 credit cards that had been used at the ATMs before the monumental theft. This operation demonstrated a level of coordination never before seen in the country, and Prilex is strongly suspected of maintaining connections with criminal organizations. Since its emergence in 2014, the group made the decision in 2016 to scrap its ATM malware and directing its entire force into PoS systems. Initial instantiations of Prilex were capable of carrying out “replay attacks”, where they did not break the EMV protocol, but instead beneﬁted from its poor implementations. Since most payment processors omit certain validations required by the EMV standard, criminals ﬁnd opportunities to exploit these ﬂaws during their operation. In this attack method, fraudsters pass oﬀ common magnectic stripe transactions as EMV transactions by controlling a payment terminal and adjusting data ﬁelds for transactions processed through that terminal. After intercepting the traﬃc of a genuine EMV chip card transaction, criminals can integrate stolen card data into the transaction sequence, simultaneously altering merchant and acquirer banking informaction in real time.

Dave Jevans, CEO and a founder of CipherTrace, is a serial entrepreneur in crypto, security, blockchain analytics and Fintech. Jevans previously founded encryption companies Receipt.com and IronKey, and he holds 26 U.S. patents, mainly focusing on cybersecurity and cryptography. The most recent patent was issued June 8th, 2021 for systems and methods for security analysis of applications on user mobile devices while maintaining user application privacy. As an early cypherpunk, he became involved in cryptocurrencies in 1999, closely tracking DigiCash, e-gold, and other early innovators. An industry expert on blockchain security, internet fraud, and cybersecurity, he has advised Congress on these topics and is frequently quoted by the media, including American Banker, Bloomberg TV, CIO Magazine, Dark Reading, Information Week, MSNBC, PC Magazine, and the Washington Post.

Adriana, a seasoned telecom expert with 20+ years of industry experience, has transitioned into cybersecurity with a passion for safeguarding digital landscapes. As the Director Responsible for Research Projects at APWG.eu, she leads international collaborations, shaping global digital security efforts. Adriana’s journey began with satellite giants Omnitracs and Globalstar, followed by a decade-long tenure at Telefonica, managing international projects in major cities. Her dedication extends to community involvement, actively participating in tech events and supporting startups as a mentor and investor. Adriana’s expertise and leadership are bolstered by her academic background, including an M.S. in Data Science and Big Data, specialized training from ESADE and IE, an MBA from IEDE/Universidad Europea Madrid, M.S. in Marketing from UFGV Sao Paulo, and a Master of Engineering degree from UNB, Brasilia.

In an era of increasing cyber threats, securing the future of software development has become paramount. This talk explores the transformative power of LAZARUS, a EU research and innovation project focused on healing security issues throughout the software development life cycle. By leveraging the DevSecOps paradigm and advanced ML/AI methods, LAZARUS intervenes in multiple steps of the SDLC, performing targeted security checks and providing actionable insights. Join us as we delve into the innovations and impact of LAZARUS in ensuring resilient and secure software, shaping the future of DevSecOps.

Tomàs Roy Català, is director of the Cybersecurity Agency of Catalonia.

Snr. Roy was born in Barcelona (Barcelonès) in 1972.

Senior Telecommunications Engineer at the UPC; senior engineer in Electronics at the Turin Polytechnic in Italy; degree in Educational Sciences at UNED; master’s degree in Management in Public Administrations from ESADE; interuniversity master’s degree in intelligence analyst from the UAB and postgraduate degree in Innovation and Design Thinking from MIT in the United States.

Snr. Roy has been certified in different areas of cybersecurity, auditing and management of ICT services and has attended courses related to his functions, such as IESE Effective Communication, among others.

Snr. Roy is a cybersecurity expert manager with more than 20 years of experience in the sector. Between 2002 and 2004 he was Director of Cybersecurity and Privacy at FIAT GM POWERTRAIN.

From 2004 to the present, he has developed different areas of management responsibility in cybersecurity in the Generalitat: 8 years in the Center for Telecommunications and Information Technologies; 2 years as executive director of the Information Security Center of Catalonia (CESICAT), 9 years as director of the Strategy area at the Cybersecurity Agency of Catalonia and until now as director of the Cybersecurity Innovation and Competence Center area of the Cybersecurity Agency.

Snr. Roy has participated as a professor in master’s degrees, courses and talks related to innovation and cybersecurity.

Pete Herzog is the shining example of a hacker trying to fix the world. He built a career out of taking apart the security world piece by piece to figure out how it works (but he still can’t put it back together). Then he writes about it, a lot. You can find articles and projects from him all over the place, especially at the non-profit research organization, The Institute for Security and Open Methodologies (ISECOM), he co-founded in 2001 to help make this happen. There you’ll find his work with the Open Source Security Testing Methodology Manual (OSSTMM), Hacker Highschool, and the Cybersecurity Playbook as well as work in trust metrics, authentication, social engineering, vulnerabilities, risk analysis, and so much more. Pete also teaches training classes, coaches corporations on cybersecurity, analyzes the security for Smart Cities, develops security products, advises start-ups, and hacks things.

His Secretariat is devoted to defining and directing the strategy for the digital transformation of the Public Administration in Catalonia; managing up to 1 billion euros per year and more than 600 public servants across the territory.
Previously, he was part of the board of the Center for the Telecommunications and Information Technologies, the public entity responsible for the technological infrastructure of the region. He occupied the Executive Offices of Digital Talent and Strategy and Innovation; and during his tenure, he worked on several initiatives such as the Digital Capabilities Reskilling Plan for all public employees, or the upholding of the public and private collaboration, among others.
He has also served as Delegate of the Government of Catalonia for the United Kingdom and Ireland, where he spent eight years promoting digital alliances on both ends.
Additionally, he also played a key role in the negotiating process for the establishment of the Mobile World Congress in Barcelona; oversaw the first industrial plan for the ICT sector in Catalonia, and advised the European Mobile and Mobility Industries Alliance for the European Commission.

APWG eCrime 2023 Speakers: Talk Abstracts – and Their Legends

SPONSORING SOLUTIONS

MEMBERSHIP

MORE IN APWG