Continuous Integration (CI) tools provide an excellent attack surface due to the no/poor security controls, distributed build management capability, and level of access/privileges in an enterprise.
In the webcast, we will have a look at the CI tools (both open source and proprietary) from an attacker's perspective and to use them as portals for getting a foothold and lateral movement. We will see how to execute attacks like command and script execution, credentials stealing, privilege escalation to not only compromise the build process but the underlying operating system and even entire Windows domains.
Nikhil Mittal is a hacker, infosec researcher, speaker, and enthusiast. His area of interest includes penetration testing, attack research, defense strategies and post exploitation research. He has 7+ years of experience in Penetration Testing for his clients which include many global corporate giants. He is also a member of Red teams of selected clients. He specializes in assessing security risks at secure environments which require novel attack vectors and "out of the box" approach. He has worked extensively on using Human Interface Device in Penetration Tests and PowerShell for post exploitation. He is creator of Kautilya, a toolkit which makes it easy to use Teensy in penetration tests and Nishang, a post exploitation framework in PowerShell. In his spare time, Nikhil researches on new attack methodologies and updates his tools and frameworks. He has spoken/trained at conferences like Defcon, Black Hat USA, CanSecWest and more. He is currently assoicated with NotSoSecure, a leading Penetration Testing and Hacking Training company. Nikhil is also teaching a class at Black Hat USA 2016.
Arabella Hallawell, Senior Director, Product Marketing Advanced Threat, Arbor Networks, has 20 years of experience in IT security and strategy. At Arbor, she leads product marketing for Advanced Threat solutions. Previously she led strategic planning and corporate strategy at Arbor. Prior to joining Arbor, Arabella was Vice President of Corporate Strategy at Sophos. At Sophos, Arabella was responsible for corporate and M&A strategy, and introduced the company's customer and market intelligence functions. Prior to Sophos, Arabella was Research Vice President at Gartner. She holds a BA from University College London and received an MA from Fletcher School of Law and Diplomacy at Tufts.