Mars Cheng (@marscheng_) leads TXOne Networks’ PSIRT and Threat Research Team as their Threat Research Manager, coordinating product security initiatives and threat research efforts. He is also the Executive Director for the Association of Hackers in Taiwan and General Coordinator of HITCON CISO Summit 2024, facilitating collaboration between enterprises and the government to bolster the cybersecurity landscape. Additionally, Mars serves as a Cybersecurity Auditor for the Taiwan Government. His expertise spans ICS / SCADA systems, malware analysis, threat intelligence and hunting, and enterprise security. Mars has made significant contributions to the cybersecurity community, including authoring more than ten CVE-IDs and publishing in three SCI journals on applied cryptography. Mars is a frequent speaker and trainer at numerous prestigious international cybersecurity conferences and has presented over 50 times, including Black Hat USA / Europe / MEA, RSA Conference, DEF CON, CODE BLUE, SecTor, Troopers, FIRST, HITB, ICS Cyber Security Conference Asia and USA, HITCON, NoHat, ROOTCON, SINCON, CYBERSEC, and many others. He has successfully organized several past HITCON events, including HITCON CISO Summit 2023, HITCON PEACE 2022, HITCON 2021, and HITCON 2020, demonstrating his commitment to advancing the field of cybersecurity.
Many enterprises heavily rely on the Active Directory (AD) as the backbone for user and asset management, distributing software updates, and related unified control mechanisms. While AD offers rich and diverse functionalities, it also leads to security risks directly or indirectly due to improper configuration settings by administrators for convenience, among other reasons. Moreover, the internal network structure of large enterprises is relatively complex, making it difficult to promptly detect ongoing attacks in the absence of comprehensive detection mechanisms. This presentation will start with the blue team's perspective, sharing how the core authentication mechanism of domain services - the Kerberos protocol operates, the attack techniques closely related to the Kerberos protocol, and how to detect such attacks in order to prevent attackers from taking over the enterprise domain services effectively and promptly.
CYBERSEC 2024 uses cookies to provide you with the best user experience possible. By continuing to use this site, you agree to the terms in our Privacy Policy 。