101 Village
Every year new blood comes out of their comfort shells, it's where Hacking 101 started, just as a small training at ROOTCON, but we've seen a significant improvement in our attendees so why not make this a village and let it grow not only to cater Hacking 101, but everything 101's, this is your beginners guide to the world of hackers and hacking.

We are all n00bs at some point! this village will kick-start your career as a professional hacker or just hacking for fun and profit.

It's not just that, 101 village also welcomes those wanting to refresh their hacking-fu skills as well.

Operator
Napz
Encrypted
s8nph

Talks
Hacking 101
Have you ever watched "Mr Robot" and got interested in the world of hacking? Or you may have encountered some stories and Facebook posts about hacking and cyber security, leaving you curious but unsure where to begin. Whether you want to be like a hacker or just interested in knowing about cyber security, then this talk's for you.

Hacking 101 is a beginner-friendly talk that introduces the essential mindset to become a hacker (not a criminal-like hacker, but that depends on you). We'll discuss the basic skills you'll need to develop and the starting points where you can learn and progress. Additionally, we'll provide insights into potential career paths, guiding you towards a successful journey in the field of cyber security. Whether you're fascinated by hacking or eager to enhance your cyber security knowledge, this talk aims to build the way for your learning.

Mobile Pentesting 101
Have you ever wondered how to conduct a security assessment on a mobile application? Have you ever wondered if there is a more secure mobile OS? Do you want to know how what happens during a mobile application assessment? If you answered yes to one of the questions, this talk is for you.

Mobile pentesting 101 aims to inform attendees how to perform a security assessment against mobile applications, covering the fundamentals of everything iOS and Android operating systems, static analysis, dynamic analysis, and mobile penetration testing.

Car Hacking Village
Automotive Security and Car Hacking have been the focus for years now. More talks and research are geared towards it because it is the trend and we owe it to the Car Hacking Village and of course to Charlie Miller and Chris Valasek. They are our inspiration to promote security awareness that cars are hackable too. Cars have computers and technologies that hackers can tap into: wireless, key fobs, CAN Bus, telematics, electronic controllers, ECUs, secure gateways and the infotainment systems.

In order to not have copyright and trademark issues with the Car Hacking Village which debuted at DEFCON 23 and was co-founded by Robert Leale aka carfucar, we contacted them through the advise of Ian Tabor aka mintynet who is also one of my fellow car hackers. And you know what, they allowed us to use their logo and supported us in our initiative since ROOTCON 13. We owe it to them and like I said they are our inspiration.

So fellow ROOTCON goers, expect some good hardware and some junks that came out of nowhere because we promise we are gonna showcase something new again today. Finally, we are showcasing one vehicle this year \m/

Operator
shipcod3
Eman0n
Shawn
Div0's Car Security Quarter (CSQ)

Tools Exhibit
- One Vehicle for PoC
- Two Instrument Clusters (Standalone)
- One Infotainment System (Standalone)
- One Automotive Firewall
- Div0's Car Security Quarter (CSQ) Test Benches (pending if they can come through call for sponsorship)
- CAN sniffers
- nano-can
- RF Tools (Flipper Zero and HackRF)
- and many more…

Activities
- CAN Injection PoC
- RF Hacking PoC
- Fuzzing
- Test Bench Demo
- Android Auto Hacking PoC
- Giving out of nano-can PCBs
- Possible Bug Bash

Talks
Analysis of an In-vehicular network: From CAN bus to infotainment by Div0 CSQ
Present-day vehicles such as the Connected vehicles (CV) include wireless and external functionalities that improve drivers' experiences. CV will continue to play a huge role in our daily lives despite mass adoptions on Electric Vehicles (EV) and testing on Autonomous Vehicles (AV). This talk will feature CSQ’s test bench 3 as we explore more features on Connected vehicles. We will talk more about Infotainment systems and the difficulties we face with setting up bench 3 and go through the vehicular architectural differences between test bench 2 and 3. Finally, we will point out some learning points and challenges.

Blue Team Tricks - An overview of Automotive Defensive Engineering By Scott Sheahan
Sun Tzu said, "If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” This talk is for car hackers to learn about modern defense measures being added to ECUs and Vehicle Architectures.

Cellular Assault Village
The Cellular Assault Village focuses on one of the most critical areas of information security - attacking cellular communications. Our primary goal is to raise awareness and educate attendees about the risks associated with unsecured cellular networks. We offer a range of equipment, tools, and demonstrations that showcase different types of attacks and vulnerabilities related to cellular networks, providing an immersive experience for attendees to learn about the techniques and tools used by cyber attackers to infiltrate and exploit cellular communications. Our aim is to equip attendees with knowledge on how these attacks are carried out.

Aside from educating attendees about scams involving mobile phones, such as sending malicious links or phishing messages, the Cellular Assault Village also addresses other potential threats. This includes demonstrations on SMS interception, call spoofing, and SMS spoofing, which are techniques used by cyber attackers to intercept or falsify communication on cellular networks. We believe it is crucial to raise awareness about these types of attacks, which can compromise sensitive data and put individuals at risk.

We showcase different types of equipment and tools to show how these attacks are carried out, allowing attendees to gain firsthand experience in how cyber attackers exploit cellular networks. By providing this immersive experience, our village ensures that attendees are well-equipped to handle the latest scams and techniques used by cyber attackers to target mobile users and secure their cellular networks

Operator
hncaga

Tools Exhibit
- SDRs (USRP, HackRF, etc)
- Small BTS
- Customized SMS and Call Interceptor (not to be used on an actual network :D)
- Cell tower sniffer (Composed of 8 Mobile phones)

Talks
Uncovering Cellphone Risks: Interception and Other Mobile Attacks
In this talk, we'll explore the world of mobile security. We'll dive into how our everyday mobile devices and the communication system connect. We'll uncover different ways that hackers can attack mobiles, from intercepting calls to faking sender names in texts. We'll also dig into how these attacks work, like reading SMS over-the-air. We'll cover both passive and active ways that hackers intercept data. Passive ones quietly gather info transmitted between devices and cell towers. Active methods, on the other hand, pretend to be real cell towers to mess with communications. As we wrap up, you'll walk away armed with insights into the potential risks that our beloved mobile devices face and equipped with knowledge on safeguarding yourself against these digital threats.

Hardware Hacking Village
The Hardware Hacking Village is a haven for those seeking to unlock the hidden potential of physical devices, harness innovation, and disrupt the status quo. Whether you’re a hardware hacking enthusiast, a curious congoer, or a seasoned hacker, this village offers an immersive, hands-on experience, providing attendees with the opportunity to engage in a multitude of activities and workshops that will surely ignite your imagination, expand your skill set, and empower you to reshape the world of technology through creative manipulation. Join us at the Hardware Hacking Village and be the catalyst for the next wave of groundbreaking innovations.

Operator
M0gul


Activities
Interactive Hardware Playgrounds: Step into interactive hardware playgrounds equipped with a wide array of devices, tools, and components. Engage in hands-on experimentation, dissect, and explore various hardware systems, and discover vulnerabilities firsthand. Collaborate with peers, exchange ideas, and learn from one another’s unique perspectives and experiences.

Device Teardowns: Participate in device teardown sessions, where you dismantle and analyze various hardware devices. Disassemble and examine the circuitry, identify key components, and decode firmware to gain insights into the device’s functionality and security mechanisms. Learn how to identify weak points, potential attack vectors, and areas for hardware modifications.

Soldering and Modifications: Develop skills in soldering and hardware modification. Learn how to desolder and replace components, add, or remove connections, and modify circuit boards to alter device behavior or introduce custom functionalities. Experiment with hardware modifications to understand their impact on security.

Lockpick Village
The Lock Picking village covers the physical side of security, simply because securing your infrastructure is not enough if the weakest link is a physical lock that an attacker can open in a few seconds. With a lock pick kit and a reset pin, one can easily be resetting your firewalls and switches in no time, God-mode activated!

This year's Lock Picking Village is exclusive to Human+ participants only, and it's all about high security locks. We will have an in-depth discussion and hands-on demo on high-security locks, the different mechanisms and ways to attack them.

Operator
schiaparelli


Talks
Safe Cracking 101: manipulating mechanical Group 2 safe locks
Mechanical safe locks have been around for a very very long time, and with good reason, many have no idea how they work. With the obscurity of this safety mechanism, we achieve security. In this talk, we explore the working mechanisms of Group 2 Safe locks, debunk some Hollywood myths and learn to exploit it's inherent weaknesses.

Recon Village
Recon Village PH is an Open Space with Talks, Live Demos, Workshops, Discussions, CTFs with a common focus on Reconnaissance. The village consists of a small group of people interested in areas of Open Source Intelligence(OSINT), Cyber Threat Intelligence (CTI), Social Media Intelligence (SOCMINT), Social Engineering and Reconnaissance, and Operational Security (OPSEC) with a common goal of encouraging and spreading awareness about these areas.

Operator
w4rh4mm3r
mndlrsbt
orzykf

Tools Exhibit
- OSIF
- SiyasatLinux
- OSINT CTF

Talks
Threat Intelligence 101
Cyber Threat intelligence is data that is collected, processed, and analyzed to understand a threat actor’s motives, targets, and attack behaviors. CTI enables us to make faster, more informed, data-backed security decisions and change their behavior from reactive to proactive in the fight against threat actors.

In the world of cybersecurity, advanced persistent threats (APTs) and defenders are constantly trying to outmaneuver each other. Data on a threat actor’s next move is crucial to proactively tailoring your defenses and preempt future attacks. This talk is to introduce the participants to the basic conceptes of CTI.

OPSEC using QUBES
Throughout our lives, we engage in various activities, such as going to school, working, voting, taking care of our families, and visiting with friends. These activities are spatially and temporally bound: They happen in isolation from one another, in their own compartments, which often represent an essential safeguard, as in the case of voting.In our digital lives, the situation is quite different: All of our activities typically happen on a single device. This causes us to worry about whether it's safe to click on a link or install an app, since being hacked imperils our entire digital existence.

Qubes eliminates this concern by allowing us to divide a device into many compartments, much as we divide a physical building into many rooms. Better yet, it allows us to create new compartments whenever we need them, and it gives us sophisticated tools for securely managing our activities and data across these compartments.

Red Teaming Village
The Red Teaming Village is designed to expose cybersecurity practitioners to various adversarial techniques and contribute to the growth and development of the red team community in the Philippines. A series of presentations and hands-on learning sessions are prepared that will immerse its attendees with the mindset of an attacker. Led by seasoned security professionals, the village provides a valuable opportunity for red teamers to practice and further improve their techniques as well as equip blue teamers the understanding and capability to prevent and mitigate such threats.

Operator
ar33zy
sif0

Tools Exhibit
N/A

Talks
Initial Payload Development: The One That Gets Away
In this talk, drawing inspiration from the phrase "The One That Gets Away," we will delve into innovative strategies and techniques employed by Red Teams to facilitate initial access. Creating effective payloads with consideration of user experience for stealth. The goal of this talk is to provide additional tradecraft for red teams and for defender to gain awareness of these tactics. The speaker will cover the Initial payload development section with concealment. Ian will also cover techniques for making payloads more reputable, which is crucial in increasing the odds for their effectiveness.

At the end of this talk will unveil ingenious techniques that go beyond traditional credential dumping, aiming to obtain sensitive credentials by luring users to willingly input their information. Through carefully crafted scenarios and engaging user experiences, we will demonstrate how seemingly safe actions can lead to unintentional disclosure of valuable credentials without the use of credential dumping techniques, and initial situational awareness considerations before executing later phases of the red team exercise.

Introduction to Red Teaming
Introduction to Red Teaming delves into the foundational concepts of red teaming, emphasizing cultivating a strategic offensive security mindset. This talk illustrates the distinction between red teaming and traditional penetration testing, showcasing how red teaming exceeds mere vulnerability discovery to encompass holistic security assessment.

Attendees will grasp the essence of adopting an adversary's perspective, enabling them to identify blind spots, anticipate evolving threats, and fortify defenses. Whether you're new to cyber security or seeking to enhance your skills, this talk provides insights into building the right mindset for impactful red teaming.