[PDF] 980 KB
 [SlideShare]

This presentation provides a timeline of my story from a local to intelligence analyst and share the inspirations and insights with the private security companies and private intelligence agencies as an industry overview before I joined. Then, the presentation will describe the organizational structure and the involved parties in this intelligence service, including colleagues, managers and clients, and share my personal difficulties while working in such structures.
Further, the second half of the presentation will focus on providing examples of the OSINT training I received and the supplementary use of HUMINT. Afterwards, the presentation will start breaking down the intelligence products by how I perceived it is used and how I find it meaningful for the corporate and government clients.
In the end, this presentation would provide my opinion on how the private intelligence industry will develop in the upcoming era with the further utilization of big data. And what I, as a junior intelligence professional, would hope for in terms of training and career development in my upcoming future.

ThaiCERT usually uses information from cyber threat intelligence to support the incident response operations, threat monitoring, and also assist law enforcement agencies to investigate cyber crime incidents. In many cases, OSINT is one of the useful information source.

This presentation will focus on how we use OSINT to support ThaiCERT operations. The topic will include interesting tools, case studies (e.g. hacktivist, fraud, malware), and challenges and limitations.

This presentation is based on our observed and real problems when using OSINT. For example, limitations of information gathering on social media, GDPR and effect on IR operations, and legal concerns when using contents from internet archive or cached services. Some topics are intentionally be open discussion in order to have participation and share experience between attendees.

The development of ML and AI allowed us to create search engines to find people by photo, API gradually become unnecessary, but what if we combine them together and understand what can be learned from social networks knowing very little about the target?
Also consider what it lead to in real life and how to protect against it.

In the report, we plan to describe the methodology of operation of these api, the statistics on the data that we were able to extract and automate this process to search for people by key criteria, such as a photo, phone number or a surname / name combination.

 [PDF] 3,310 KB
 [SlideShare]

Phishing, an old and traditional attack, is still a thing. 
Hundreds of phishing website are launched every day and it threats people around the world. Anti-Phishing Working Group (APWG) says that APWG detected 150,000+ phishing websites for the 3rd quarter of 2018.

Sometimes phishing actors make OPSEC failures and, thanks to that, researchers can obtain a phishing kit (a kit to deploy a phishing website).
We have collected 18,000+ phishing kits based on OSINT and analyzed mechanisms of phishing websites and phishing actors themselves.

In this presentation, we will show the following findings.
- How to collect phishing kits based on OSINT data.
- Analysis of phishing actors:
  - Who develops a phishing kit, How to distribute it, etc.
    - Including a methodology to find out a phishing actor based on information (email, username and signature) inside a phishing kit.
  - We will show an analysis of Indonesian phishing actors who target Asian countries.
    - Especially focusing on an actor named DevilScream/Z1Coder who develops an infamous phishing kit“16shop”.

Finally, we will show countermeasures we have taken against phishing websites and actors.

 [PDF] 1,951 KB
 [SlideShare]

In July 2016, the ATM heist of Taiwan First bank is based on well-known Carberp malware family. The threat of cybercrime is becoming increasingly complex and diverse on putting citizen’s data or money in danger. Cybercrime threats are often originating from trusted, malicious, or negligent insiders, who have excessive access privileges to sensitive data. The analysis of ATM heist threats presents many opportunities for improving the quality and value of digital evidence. This talk will introduce some OSINT methods that can help investigators to perform a cybercrime investigation process in a forensically sound and timely fashion manner. This talk further points out cybercrime investigation, digital forensics, and ICT governance for fighting against cybercrime issues. It requires the sincere examination of all available data volumes at a crime scene or in a lab to present digital evidence in a court of law.

References:
 Exploring the cybercrime investigation framework of ATM Heist from ISO/IEC 27043:2015
 WhatsApp Network Forensics: Discovering the Communication Payloads behind Cybercriminals
 Forensic Analysis of Network Packets from Penetration Test Toolkits
 Practical Packet Analysis: Exploring the Cybercriminal behind the LINE Voice Calls

 [PDF] 15,715 KB
 [SlideShare]

Nowadays, the knowledge and skills of cyber security are necessary for the work of police officers in Thailand which conforms to the changing world society to the digital society.
Currently, the nature of crime in Thailand is related to the offense on computer and digital systems more than in the past. Therefore, Royal Thai Police assigned the Police Cadet Academy to establish the guideline and the special cybersecurity project for enhancing and training the future law enforcement leaders, police cadets, in understanding cybersecurity and cybercrime. In this paper presents the program outline in cybersecurity training for Thai police cadets at Royal Police Cadet Academy. The main knowledge and skills, which are highly needed for police cadets, consist of 7 parts: computer programming, digital forensics, reverse engineering, cryptography, web security, exploitation and network monitoring. Moreover, military forces and police department have initiated the cyber security competition for the military-police academies in 2018. This challenge made changes in encouraging police cadets to equip themselves more efficiently for the prevention of threats in computer system. The Royal Police Cadet Academy is the main institution in Thailand to prepare cybersecurity knowledge to the law enforcement leaders. The department of police science is adapting the cybercrime cases from different to cadets. The department of forensic science is training to fight the cybercrime in the proper methods under the law.
Kali Linux will be used as the main training software in Royal Police Cadet Academy, Royal Thai Police.

References:
 8th INTERPA, February 11-13, 2019, GFSU, Gujarat, India

 [PDF] 2,271 KB
 [SlideShare]

The Data Privacy Act of the Philippines was enacted into law in March of 2012.  Thus, the creation of the National Privacy Commission (NPC) last 2016, which is mandated to administer its implementation. After more than two years after its creation, NPC had successfully championed its cause from awareness, compliance and enforcement with the registration of more than 30,000 Data Protection Officers (DPO), accepted more than 1,000 complaints and cases and has made headlines in the Philippines as one of the most popular government because of its strict implementation of the law. Among its most popular implementation is its Five Pillars of Compliance which was regarded as one of the most successful implementation among other countries. Republic Act 10173, otherwise known as the Data Privacy Act (DPA) of 2012 was passed into law last 2012 in the Philippines. The law requires that all Personal Information Controllers (PIC) and Personal Information Processors (PIP) must appoint a Data Protection Officer (DPO) to manage compliance with the DPA and other applicable laws and policies.  In addition, having a DPO will ensure the protection of personal data collection and processing in accordance with the requirement of the law.

Having a DPO will also ensure the organization’s competitive advantage in this digital age of data protection.

As a data protection officer, he/she must be must monitor the organization’s compliance with the DPA, its implementing rules and regulations and other issuances by the National Privacy Commission. Including the conduct of Privacy Impact Assessment, creation of a Privacy Management Program and Privacy Manual and the conduct of Breach Reporting Procedure.

In addition, a DPO should cultivate awareness to promote the culture of privacy not only within the organization, but as well as for the entire country.

The presentation will also present some issues surrounding the digital world.  Including some potential breaches that may affect each individual and organization.  Will also present a compilation of the most common breaches that has happened in the Philippines and how to avoid them. Technical, physical and organization security measures will also be discussed in the presentation.

References:
 National Privacy Commission Philippines

 [PDF] 5,614 KB
 [SlideShare]

TWCSIRT is a full member of FIRST and mainly focuses on the protection of NARLabs, TANet and TWAREN. We are defense cyber-attack from internet and according to government policy to handling incident every day. I am a research fellow with National Center for High-performance Computing and lead cyber security team to operation security operation center to handling incident in Taiwan Academic Network.
In our research project from government, we are deployed the biggest honeynet in Taiwan and used over 6000 IP address to detection malicious network attack come from internet.
We have published our malware knowledge base to sharing malware samples and reports for many researchers, students, research center and sharing our data set for deep tracking about cyber security.
There are many new types of cyber-attack that’s is include ransomware, website mining, DDoS and hybrid malicious attack.

Main Points:
- What’s TWCSIRT Mission and Scope
- How to coordinate in National level with ISAC, CERT and SOC
- Cyber-attack and threat hunting in Taiwan Academic Network
- How to develop cyber security platform for incident handling
- How to do red team and blue team training by CDX

References:
 TWCSIRT
 Malware DB
 Cyber Defense Exercise
 SP-ISAC

South East Asia is a rapidly growing economy, and many countries have aggressively sought to modernize its information technology capabilities as they assimilate into the global digital economy. However, this rapid expansion without adequate security considerations has led to the creation of the perfect storm – with multiple open critical vulnerabilities across governments and institutions in the region. As the name suggests, Hacktivism is largely spurred by politically motivated activists, using tools which exploit cyber security vulnerabilities. Geo politics is the main driver for Hacktivism.
A significant example would be the 2012 Scarborough Shoal incident between China and Philippines.
Chinese hacktivists defaced websites of the University of the Philippines website, Philippine Department of Budget and Management and that sparked off a chain of retaliation activities by Hacktivists groups in the Philippines on Chinese entities.
Hacktivists groups also demonstrated remarkable maturity to organize cross-national campaigns in #OpChina. In this campaign, FireEye Intelligence identified Indonesian hacktivists partnering with Filipino and Vietnamese hacktivists in #OpChina, and they launched defacements, distributed denial-of-service (DDoS) attacks, data leaks, cross-site scripting (XSS) attacks, and spam activity on Chinese targets. In retaliation, nationalistic Chinese hacktivist groups and communities started operation "Kill the Monkey," which targeted Philippine, Vietnamese and a few US websites.
While the threat activity conducted in support of #OpChina and "Kill the Monkey" was low in sophistication, this activity was remarkable due to the high levels of participation on both sides. There are indications which suggest that at the peak of activity was on May 30, 2015, more than 20,000 Chinese Internet users were participating in chat rooms that had been created to organize pro-China cyber threat activity.
Hacktivists are also starting to challenge international affairs outside of the geopolitical scene in SEA. For example, Indonesia-based actor "Minion Ghost" (@Scode404) participated in #OpIsrael and #OpCatalunya campaigns.
Traditionally, the threat level emanating from hacktivists groups have been low, but over the last 24 months FireEye Intelligence has been observing hacktivism attacks take on a more destructive role as compared to traditional website defacements / DDoS attacks. In 2016, pro-ISIS hacktivist group Islamic Cyber Army compromised and deleted sensitive records from the U.S. Department of Commerce (DOC) website in retaliation for the death of Junaid Hussain. In 2019, it is possible that hacktivists adopt more complex TTPs such as leveraging data destruction as an anti-forensic technique in their campaigns.
Since 2018, FireEye Intelligence has observed with moderate confidence that the threat of hacktivism in support of the Islamic State (ISIS) terrorist organization has declined since its peak in 2015 – this is consistent with the substantial losses in ISIS territory and personnel in Syria.
Hacktivism attacks historically consists of the following methods – Data leakage, Doxing, Denial of Service Attacks, Website Defacements, Website Redirects – but as Information Operations (Fake news) gains traction as an effective medium to incite public sentiments, we could see hacktivists adopting this weapon in 2019 – where it is election season in 2 prominent SEA countries (Indonesia, Thailand).

 [PDF] 226 KB
 [SlideShare]

An analysis of section 161 of the Crimes Ordinance and sharing of case law on this offence.

References:
 ONC Newsletter - September 2018

Recently many cryptocurrency exchange websites and users have been targeted by phishing attempts.
While analyzing the various cases, the Horangi R&D team adopted OSINT techniques for retrieving information about the malicious websites, the target cryptocurrency addresses and the attackers.

In this presentation, the Horangi R&D team will show “how to find suspicious information from Deep Web & Surface Web” and describe the best ways for reaching this goal.

The team will share some real cases related to malicious phishing websites and crypto addresses on Deep Web. The first case is about fake giveaway websites looking like real news portals, while the second case is about phishing websites imitating those of the exchanges.

The final part of the presentation is dedicated to finding korean data leaks with some real examples.

Bitcoin Security Model | Bitcoin Governance | Bitcoin Regulation

The full presentation is available on YouTube:
 https://www.youtube.com/watch?v=X_xgmVLyB94

The talk aims to share knowledge about how tech monopolies arise as an emergent behaviour of doing a data dissemination over a point-to-point communication system.
The problem has shifted, we no longer use TCP/IP to just connect to machines, we're also using it to do content dissemination in the form of videos, audio, websites and advertising.
Some 90+% of the internet traffic today is content dissemination.

A new Named Data Networking protocol is needed to ameliorate this problem. A design that divorces data from location, is IoT friendly, and builds strong security directly into the protocol.