conf 2017-11-16 11:30 – 12:30 EN

Turla APT – Attack againste Ruag Conf

Name: Black Alps 2017
Start: 2017-11-15
End: 2017-11-16
Location: Y-PARC, Yverdon-les-Bains

Abstract

The Turla actor group has successfully attacked the MFA in Switzerland as well as defense company RUAG. Since then, GovCERT.ch has been analyzing the tactics and toolbox of this group. We are going to present the malware involved, detection possibilities, as well as defense strategies. The talk is based mainly on the already published report about the Ruag incident (https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case). This talk is held under TLP RED, so no recording or broadcasting possible.

Speakers

Andreas Greulich

MELANI/GovCERT.ch

Andreas Greulich was born in 1967 and studied Applied Mathematics at the University of Berne, which he finished with his PhD about genetic algorithms in 1995. He then joined the Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT), and changed to the Federal IT Steering Unit a few years later, with focus on network security. Since 2007, he's malware researcher at GovCERT.ch, which is part of MELANI, the Reporting and Analysis Centre for Information Assurance. Besides, he's giving courses in Reverse Engineering at the University of Applied Science in Berne.

Reto Inversini

MELANI/GovCERT.ch

Reto Inversini was born in 1971 and studied Geography / Climatology at the University of Berne and Information Technology at the University of Applied Science. He worked for Amnesty International as a Network Engineer and for the Swiss Federal Office of Information Technology, Systems and Telecommunication (FOITT) as a Security Architect. Currently he works in a double role as a Security Officer and Technical Analyst at GovCERT.ch. He is a part time teacher at the University of Applied Science in Bern and Biel in the domains of Security Incident Response, Network Design and Security Architecture.

Talk

Turla APT – Attack againste Ruag Conf