Keynotes (50 Minute)
- Bruce Schneier - "Trust, Security, and Society"
- Abstract: Human society runs on trust. We all trust millions of people, organizations, and systems every day -- and we do it so easily that we barely notice. But in any system of trust, there is an alternative, parasitic, strategy that involves abusing that trust. Making sure those defectors don't destroy the cooperative systems they're abusing is an age-old problem, one that we've solved through morals and ethics, laws, and all sort of security technologies. Understanding how these all work -- and fail -- is essential to understanding the problems we face in today's increasingly technological and interconnected world.
- Bio: Bruce Schneier is an internationally renowned security technologist and author. Described by The Economist as a "security guru," he is best known as a refreshingly candid and lucid security critic and commentator. When people want to know how security really works, they turn to Schneier.
- Josh Corman && Jericho - "Cyberwar!": Not What We Were Expecting
- Abstract: With all the hyperbole and rhetoric surrounding "Cyber-War", we've grown
blind to the real conflicts. Cyber-War is upon us, but it is NOT like you
expected. Citizens are all involved (or will be), but we are not prepared. The conflicts don't have clean battle lines, aren't fought by or between
traditional states, and are far more personal and idealogical.
Historically, we have only seen cyberwar through failed analogies, or our
own greedy lenses. In doing so, we have failed to give proper attention to
the subject, let alone understand it. This talk will be more than an
honest analysis of the past, present, and near future of cyber-war. From
the DARPAnet goals of the Internet, to the original AntiSec's "inevitable
conflict", to the guerilla warfare that we must come to understand, we'll
outline what cyber-war isn't and, more importantly, what it is and will
become. When the shit hits the fan, what role will you play? It's past time to
prepare yourself; will you be a warrior, minute man, survivalist, or
collateral damage?
- Bio0: Joshua Corman is the Director of Security Intelligence for Akamai Technologies and has more than a decade of experience with security and networking software. Most recently he served as Research Director for Enterprise Security at The 451 Group following his time as Principal Security Strategist for IBM Internet Security Systems. Mr. Corman�s cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges plaguing the IT industry, and helps to drive evolutionary strategies toward emerging technologies and shifting incentives. Mr. Corman is a candid and highly-coveted speaker with engagements at leading industry events such as RSA, DEFCON, Interop, ISACA, and SANS. As a staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, and co-founded Rugged Software � a value-based initiative to raise awareness and usher in an era of secure digital infrastructure. His passion for challenging the status quo won him the title of Top Influencer of IT by NetworkWorld magazine in 2009. Corman received his bachelor�s degree in philosophy, graduating Phi Beta Kappa and summa cum laude, from the University of New Hampshire. He resides with his wife and two daughters in New Hampshire.
- Bio1: Jericho has been poking about the hacker/security scene for over 19 years
(for real), building valuable skills such as skepticism and anger
management. As a hacker-turned-security whore, he has a great perspective
to offer unsolicited opinion on just about any security topic. A long-time
advocate of advancing the field, sometimes by any means necessary, he
thinks the idea of 'forward thinking' is quaint; we're supposed to be
thinking that way all the time. No degree, no certifications, just the
willingness to say things many in this dismal industry are thinking but
unwilling to say themselves. He remains a champion of security industry
integrity and small misunderstood creatures.
FULL Length (50 Minute)
- Phil Young - "Mainframes? What the F&#K is that about?"
- Abstract: The mainframe is not legacy, far from it. Not only is it not legacy,
but the majority of fortune 100 companies run a current and up to date
mainframe OS. Airline, insurance, financial, power and oil industries,
governments and three letter agencies, worldwide, run them, yet no one
in the community knows how to properly tackle these 'iron beasts'. Be
it a lack of access by the security community or the false notion that
mainframes are dead, there is a distinct gap between the IT security
world and the mainframe world. This presentation aims to help close
this gap by talking about common security pitfalls on the mainframe
and how you can take advantage of, or secure against, them. After this
talk you'll be able to talk intelligently about mainframes, use SHODAN
to find mainframes, enumerate and brute force users, crack the
password database with John the Ripper and run netcat. Since
mainframes are a big world, I will also show you how you can run your
own mainframe at home on whatever old laptop you've got laying around
using opensource software so that you too can get your hands dirty!
- Bio: Ever since he saw the movie TRON, Phil has been fascinated with
computers, mainframes especially. Throughout his career he's had the
chance to review mainframe security at various large organizations. He
has worked in IT security for 9 years but ever since he learned you
could emulate your own mainframe he's been knee deep in JCL, print
queues and OMVS. Some people build toy trains, others model airplanes,
but Phil's hobby is mainframe security. He has given a talk about
mainframe security at BSidesLV, has been interviewed for podcasts and
maintains a blog about mainframe security research.
- Shawn "lattera" Webb - "Runtime Process Insemination"
- Abstract: Writing malware on Linux isn't an easy task.
Anonymously injecting shared objects has been a frightful task that no
one has publicly implemented. This presentation will show how and why
malware authors can inject shared objects anonymously in 32bit and
64bit linux and 64bit FreeBSD. The presenter will be releasing a new
version of a tool called libhijack. libhijack aims to make injection
of arbitrary code and shared objects extremely easy. There will be a
live demo injecting a root shell backdoor into multiple programs
during runtime.
- Bio: Shawn Webb is a professional security engineer. He has
been studying and developing runtime process infection techniques for
the past few years.
- David Mortman - "Automating The Shit Out Of Security"
- Abstract: Doing defense is hard. Time and budget are both limited resources . On top of that, many (most!) organizations are getting owned, not because
the miscreants are talented, but because we aren't doing the basics
very well. And why not? Because doing the basics if really really
repetitive and boring. It's just not sexy so most people don't want to
work on it. Repetitive tasks are not only boring, but are also error
prone which makes the situation even worse. So let's automate the shit
out of the boring stuff so we can focus on the complex and sexy stuff.
Or as Ian Amit says, let's make defense sexy. I'll show you some cool
ways to let computers do the stuff they are good at so we humans can
do the stuff we are good at. Not only will there be sexy defense, but
also (as is traditional) baked goods as well.
- Bio: David Mortman is the Chief Security Architect for enStratus and a
Contributing Analyst at Securosis. Most recently he was the Director
of Security and Operations for C3, LLC. Formerly the Chief
Information Security Officer for Siebel Systems, Inc., David and his
team were responsible for Siebel's worldwide IT security
infrastructure, both internal and external. He also worked closely
with Siebel's product groups and the company's physical security team
and is leading up Siebel's product security and privacy efforts.
Previously, Mr. Mortman was Manager of IT Security at Network
Associates, where, in addition to managing data security, he deployed
and tested all of NAI's security products before they were released to
customers. Before that, Mortman was a Security Engineer for Swiss
Bank. Mr. Mortman is a regular speaker at RSA, Blackhat and Defcon. In
the past year, he has presented at RSA, Secure360, Sector, Blackhat,
Defcon and BruCon. Mr. Mortman sits on a variety of advisory boards
including Qualys, Lookout and Virtuosi amongst others. He holds a BS
in Chemistry from the University of Chicago.
- Philip Polstra - "Mesh Stalkings"
- Abstract: This presentation will show attendees how to use The Deck, an Ubuntu-based full-on penetration testing and forensics distro
which runs on the BeagleBoard and BeagleBone family of boards, in a connected mesh network. The Deck is an open source
system which debuted in London in September 2012. It contains hundreds of tools which have been ported to the ARM platform.
Having a full system (complete with X Windows) in a small low-power package allows for great flexibility in penetration
testing. The Deck can be run for days to weeks off of battery power. An entire penetration testing platform can
be housed in a small child's lunchbox. This presentation will focus on the MeshDeck addon to The Deck. The MeshDeck adds ZigBee networking capabilities to The Deck. The addition of the MeshDeck adds considerable power and flexibility to an already powerful system. For example, a few
BeagleBone versions of The Deck can be outfitted with ZigBee radios and then dropped at a customer site where they can
run off battery power for an entire pentesting engagement while sending information on which networks/passwords/etc. they
have cracked back to the pentester who is sitting in his car a mile away running TheDeck on his BeagleBoard complete with 7" touchscreen.
This entire setup can bit fit into two lunchboxes. Attendees will leave with a better understanding of what is possible with small, low-powered devices. Attendees will also
get an idea of what is required in order to port a Linux distro and/or applications to a new platform. An overview of ZigBee
mesh networks will be presented. To get the most out of this presentation attendees should be familiar with penetration testing,
and Linux. Experience programming in C would also be helpful, but not required.
- Bio: Phil was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450.
Two years later he learned 6502 assembly and has been hacking computers and electronics ever since. Phil currently works as a professor at a private Midwestern university. He teaches computer security and forensics.
His current research focus involves use of microcontrollers and small embedded computers for forensics and pentesting.
Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the
usual certs one might expect for someone in his position. Phil is also an accomplished aviator with several thousand hours of flight time. He holds 12 ratings including instructor,
commerical pilot, mechanic, inspector, and avionics tech. When not working, he likes to spend time with his family, fly,
hack electronics, and has been known to build airplanes.
- Robert Rowley - "Teaching your WAF new tricks"
- Abstract: This isn't your uncle's "what's a WAF" talk, I'll be covering as many cool tricks and advance topics related to deploying Web Application Firewalls. I will show you how to write custom scripts using lua and mod_security, and give first hand experiences of how I used scripting with a WAF to put the security team at my previous job ahead of the game when dealing with web app attacks. I will be including the source code for these example scripts which can be used to provide automatic incident response, counter-intelligence and more.
- Bio: A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).
- James M. Drake - "Mobile security, forensics & malware w/ Santoku"
- Abstract: Did you think there were a lot of mobile devices and platforms out there? Check out the hundreds of mobile tools being developed. We calculated it would take more time to install, test and maintain the various mobile tools than to actually fuzz the hell out all existing mobile operating systems. So, we created Santoku Linux, a F/OSS, bootable Linux distro to make life easier for mobile hackers. We pre-install not only the mobile platforms but promising tools in development. Santoku covers mobile forensics, mobile malware analysis and mobile security testing. This talk will introduce Santoku and provide demos of 1) how to forensically acquire and analyze Android and iOS devices, 2) several tools to perform security audits of mobile devices and apps, and 3) an approach to mobile malware analysis. All demos will leverage tools preinstalled on Santoku Linux. As a bonus, the talk will demonstrate another very different type of hacking. Throughout the talk, the sport of hacky sack (footbag) will be discussed and demoed including origins, how to play, why hacky sack is a great sport for hackers and how to perform different freestyle tricks. Audience participation will be encouraged.
- Bio: James M. Drake is a mobile security researcher with a unique professional and educational background. After training in applied statistics and probability theory on the trading floors of the Chicago Mercantile Exchange, James became a successful independent trader of equities and commodities. His keen interest in electronics and information security led him to shift gears and pursue computer science and mobile security. At viaForensics, his area of research includes mobile exploits, JTAG, Android and iOS forensics. He has thus far decided to remain amateur in the sport of hacky sack.
- David Schwartzberg - "Fun with Exploit Kits for Tech Support"
- Abstract: Inspired by Adam Johnson's presentation at GrrCON 2011 titled "ZeuS - Inside Command and Control" on how to build a ZeuS bot Exploit Kit Command & Control. I thought it would be fun to use this newly gained knowledge to build a C&C in an effort to provide tech support for my mother in-law. Have you been in that situation where everyone you know comes to you with their computer problems? Just because you have a knack for technology, people you know seem to think that you enjoy fixing all their problems, most self-inflicted. Welp, here's your chance to help them and have some real fun. This mostly hand's on demonstration will walk through setting up your very own C&C and configuring the basic settings to get you started. When ready to rock, you will learn one way to get your victim to willfully become "infected" (inform them to disable AV first) and how you can have fun while fixing their problems. All of this will be covered while drinking beer and cooking bananas foster.
- Bio: David Schwartzberg is a Senior Security Engineer at Sophos, a security company where he specializes in data protection. He is a co-founder of the Chicago InfoSec Underground meetup. David wrote the original CramSession study guide for the Network+ certification in 1999 and published "Computers for Kids: Something In, Something Out" in 2011. Utilizing his 6 years accounting experience and 17 years Information Technology experience, he speaks regularly with technology executives and professionals to help protect their corporate secrets and stay compliant.
TURBO Talks (25 Minute)
- Dan Kuykendall - "Get off your AMF and don�t REST on JSON"
- Abstract: HTTP is being used to transport new request formats such as those from mobile apps, REST, JSON, AMF and GWTk, but few security teams have updated their testing procedures. All of these new formats are potential new playgrounds for attackers and pen testers. You just need to know how to play. In this talk, Dan Kuykendall will demonstrate the process of breaking down these new formats and where to attack them on various vulnerable applications. Most of the attacks are the familiar classics like SQL and Command injection applied in modern applications. Attendees will learn to leverage their existing pen testing skills and techniques and apply them to these new formats.
- Bio: Dan has been with NTO for more than 10 years and is responsible for the strategic direction and development of products and services. He also works closely with technology partners to make sure our integrations are both deep and valuable. As a result of Dan�s dedication to security, technology innovation and software development, NTO application security scanning software is often recognized as the most accurate because of its sophisticated automation techniques. Dan joined NTO from Foundstone, where he was a key developer of FoundScane�s scan management, and remediation capabilities. Before Foundstone, Dan was the founder of the Information Security team in the United States branches of Fortis. When Dan�s not working on NTO products or screen sharing with our customers to help them solve their application security challenges, you�ll find him blogging, co-hosting An Information Security Place Podcast and speaking at conferences like B-Sides, OWASP AppSecUSA, HouSecCon, ToorCon and more. He also works with industry groups and contributes to many open source development projects. Little known fact about Dan, he was a founder of the phpGroupWare project and creator of podPress.
- int0x80 && FuzzyNop - "Incident Response Response"
- Abstract: Attackers intending to maintain persistence in a network need to keep their tools and malware away from prying eyes. We regularly detect and identify systems compromised during campaigns, then acquire and analyze the tools and malware used in the attack. We are the prying eyes. Common mistakes made by attackers get their intrusions noticed, and their persistence removed. As a result, the attacker's tool or piece of malware finds its way into our instances of IDA Pro. In this talk we examine common mistakes made by attackers during targeted attacks. We also present approaches to remedy these mistakes. We will be releasing an open source tool that aims to thwart the identification of an attacker's tools or malware on a compromised system, and is thus, a response to incident response.
- Bio0: int0x80 is the rapper in Dual Core.
- Bio1: FuzzyNop is a guy who knows how to computer. As a child his parents always told him he should do computers and now he spends his free time making malware go backwards (aka reverse engineering malware). He is hopelessly addicted to CTF, and has competed in a number of CTFs including the US Cyber Challenge the past two years. This year his team won the DerbyCon CTF. At his day job he performs incident response and investigates intrusions related to targeted attacks, otherwise known as APT.
- Josh "m0nk" Thomas - "Meshing Stuff Up"
- Abstract: We want to crush all the misinformation and mesh all the phones. Tired of the cellular network going down or WiFi being untrustworthy?
Join the SPAN team in a deep dive of mesh / mobile ad-hoc networking
of Android devices. Before they were a team, the members of project SPAN thought it was
highly limiting to only be able to network smart phones over standard
Wi-Fi or with a Cellular infrastructure. Honestly, the SPAN team isn't
a big fan of infrastructure-based networks in general. They wanted a
headless, dynamic network that allowed for resilient communications
when the other infrastructure either wasn't available or when they
just didn't feel like using it. They also really liked the idea of a
communication system where there was no central router, server or
other central point of sniffing of data. With this in mind, they
teamed up and created project SPAN (Smart Phone AdHoc Networks). They
decided to open source the project and to share not only the code but
also the whole process and idea with the community at large. The team
is annoyed that the current generation smart phone radios have the
intrinsic ability to communicate directly with one another, but
hardware vendors and mobile OS frameworks don�t make it easy to do so.
Let us show you how it can be done and the fun that can be had from
it. Join the SPAN team for a deep dive into the Android network stack
implementation and its limitations, an analysis of the Wi-Fi chipsets
in the current generation of smart phones and a collection of lessons
learned when writing your own network routing protocol. The team will
also share a "How To" walkthrough into implementing your own Mesh
network and incorporating general "Off Grid" concepts into your next
project; this will include securing your mesh from outside parties
while tunneling and bridging through the internet. The team will delve
into specific Android limitations of Ad-Hoc networking and provide
workarounds and bypass mechanisms. Lastly, the team will expound upon
securing the mesh landscape and how to effectively evade traffic
sniffing over an inherently open network.
- Bio: Josh "m0nk" Thomas is a Security researcher, mobile phone geek, mesh
networking evangelist and general breaker of things electronic. His
past projects have commonly spanned the hardware / software barrier
and rarely have a UI. He's spent the past 12 years poking at embedded
systems, networks, IP stacks, AI and right-time communication systems.
A code monkey at heart, m0nk has spent the last year digging deep into
Android and iOS internals, with a major focus on both the network
stack implementations and the driver / below driver hardware
interfaces. He uses IDA more frequently than Eclipse, really just
likes playing with gadgets and wants to make the world a better place.
His life dream is to ride a robot unicorn on a moonlit beach. m0nk is
currently employed by Accuvant LABS R&D Team.
- Ben Ten - "Creating A Powerful User Defense Against Attackers"
- Abstract: Does your security defense stop at the firewall,
antivirus, logging, auditing, and the IDS? Regardless of the size or
complexity of your perimeter security if your user clicks on a malicious
link or opens an infected file it could still be 'game over' for your
network. One of the strongest defenses is knowledge and empowerment. In
this talk, I will show you how we were able to get our executives, IT team,
and all of our users excited about security with a unique approach to User
Security Awareness Training. I will show you examples of how we convinced
everyone in our organization that they are a part of the security defense
team. I will show you what worked and what didn't work when we implemented
this in our organization. I'll talk about how these techniques that I used
in an organization of 70 employees can work at organizations of all sizes.
I will give you practical tools to sell the idea to your boss, sell the
idea to your IT team, and sell the idea to your users which will help you
create a powerful user defense against attackers.
- Bio: Ben Ten is the Vice President of Information Systems and the
Security Officer for a medical billing company in Illinois. I have 11
years of experience doing Application & Web Development; Security
Implementation, Consulting, & Training (Blue Team); Federal
Regulation and Compliance oversight in relation to Information
Technology (HIPAA, HITECH, PCI); and managing a team of developers
and IT professionals.
- James Arlen - "The Message and The Messenger"
- Abstract: You are a great person - a unique and special snowflake - you have many brilliant ideas. You are completely ineffective at getting those ideas
out of your head and to an audience. If you need to stand up in front of
a crowd of more than zero and persuasively deliver information - you
need to be here. Whether delivering a status report or standing in front
of an audience, there are ways to deliver information that will increase
the chances that people will retain and act upon it. Join this
fast-paced talk during which there will be some instruction, some ugly
self-evaluation and path you can follow to get from *Idea* to
*Delivery*. Stop presenting like crap and failing to get your point across.
- Bio: James Arlen, sometimes known as Myrcurial, is a security consultant at
Leviathan Security Group usually found in tall buildings wearing a suit,
founder of the Think|Haus hackerspace, contributing analyst for
Securosis, columnist at Liquidmatrix Security Digest, Infosec geek,
hacker, social activist, author, speaker, and parent. He�s been at this
security game for more than 19 years and loves blinky lights and shiny
things.
- Jonathan Claudius - "Attacking Cloud Services w/ Source Code"
- Abstract: It is a lot of work to ensure that an open source project runs the correctly
on all of its supported platforms. Fortunately, there are a growing number of
cloud-based services that offer to remove this tedium, and for free! They will
download, compile, and *execute* your code and let you know if everything goes
as planned. This presentation will explore attack scenarios that could happen
if malicious source code is fed into these services and provides perspective,
advice and a new tool to help defend them from compromise.
- Bio: Jonathan Claudius is a Security Researcher at Trustwave. He is a member of Trustwave's SpiderLabs -the advanced security team focused on penetration testing, incident response, and application security. He has eleven years of experience in the IT industry with the last nine years specializing in Security. At Trustwave, Jonathan works in the SpiderLabs where he focuses on vulnerability research, network exploitation and is the
creator of the BNAT-Suite. Before joining SpiderLabs, Jonathan ran Trustwave's
Global Security Operations Center.
- Daniel Peck - "Scripting Android Applications"
- Abstract: This will be a walk-through presentation on dynamic exploration
of Android apps using JRuby. We'll give an overview of the entire
process, beginning with tools to disassemble the package, followed by a
crash course in understanding smali disassembly, modifying, and
rebuilding APKs. Finishing up with a tutorial on running code from a
targeted android package within a jruby session and a discussion on what
this allows us to do, such as access APIs restricted to mobile only,
extraction of secret keys, and bypassing/calling custom crypto routines.
We'll conclude with discussion of popular obfuscation techniques that reversers are likely to encounter when performing this work, and a few quick dives
into popular apps to show audience members what to expect.
- Bio: Peck is a Research Scientist at Barracuda Labs at Barracuda Networks. He's interested in studying the security implications of and malicious messaging
on social networks, and industrial control systems, and reverse engineering.
He has a Bachelors of Science in Computer Science from the Georgia Institute of Technology.
- Mike Kemp - "Everything Old is New Again"
- Abstract: A lot of talks focus on the shiny new tech (*cough* Android *cough*). It�s understandable. If as a researcher you find 0day in this months
latest hot technology you are almost certainly getting press coverage,
which means either your salary / day rate is increasing, or you are
getting a better job. Sadly, so called �legacy� technology is often
ignored (it certainly isn�t mentioned much in most talks or books).
Organisations that provide critical infrastucture do not ignore legacy
technology, and neither should any penetration tester that claims to
know their craft. This talk will look at some of the more often
ignored legacy systems, and how to assess them without knocking over
huge chunks of an internal estate. Topics covered will include, AS400,
why RFI still works, VMS, PBX, X.25, SCADA PLCs, and all manner of
�old� stuff you can find deployed in the real world. There will be no
*significant* 0day (although the author does have some juicy details
on SCADA systems and PLCs), but attendees will hopefully come away
fired up and wanting to play with some old school tech.
- Bio: Michael is an experienced UK based security consultant, with a
specialization in the penetration testing of web applications and the
testing of compiled code bases and DB environments to destruction. As
well as the day job, Michael has been published in a range of journals
and magazines, including heise, Network Security, Inform IT and
Security Focus. To date, Michael has worked for NGS Software, CSC
(Computer Sciences Corporation), British Telecom, and a host of
freelance clients throughout the globe. Presently, Mike is working in
a day job for Xiphos Research Labs (which he really has no choice in
as he set it up). When not breaking things, Michael enjoys loud music,
bad movies, weird books and writing about himself in the third person.
Mike has previously presented at security conferences in Jakarta,
Hawaii, New York, Los Angeles, Warsaw, Prague, Holland, Zagreb,
Krakow, Quebec, and London (on subjects as diverse as virtualisation,
malware, and why the government sucks), and is always keen to
embarrass himself in new and exotic locales.
- VideoMan - "Hack your Raspberry Pi, & Hack w/ your Raspberry Pi"
- Abstract: All the fun things one can do with this little embedded box of fun! I'll talk about my experiences, such as WarDriving, Sensor input, and making a CatFeeder for fun! I'll give a demo of All the fun tools that one can run on this cheap hardware.
- Bio: David "VideoMan" Bryan has more then 10 years of computer security experience, including pentesting, consulting, engineering, and administration. As an active participant in the information security community, he volunteers at DEFCON, where he designs and implements the firewall and network for what is said to be the most hostile network environment in the world. In his spare time he runs the local DEFCON group, DC612, is the president of The Hack Factory, and helps to run THOTCON as an OPER.
Workshops (2.5 Hour)
- Jim Rennie && Marcia Hofmann - "Hacker Law School"
- Abstract: Many law presentations at hacker conferences cover recent legal
advances or highlight specific issues. But what about the baseline
knowledge you need to just stay out of trouble during your online
interactions? Come to Hacker Law School, and learn the basics!
- Bio: Jim Rennie is an attorney, and is currently Senior
Product Counsel at TRUSTe in San Francisco, where he specializes in
Internet privacy law, among other things. Previously, he was has been
Public Defender and a software developer. He has spoken around the
country on topics concerning law and technology.
- Bob Weiss - "Crypto for Hackers"
- Abstract: Cryptography has been the weapon of choice for generations of spies, generals, and governments. Today, crypto is the foundation for secure communications, e-commerce, and online anonymity. Yet crypto still gets cracked or brute-forced. What gives? Crypto is like a parachute -- it's dangerous to roll your own unless you're a professional. Nobody can make you a pro in 2 1/2 hours, but this workshop will give you a working knowledge of cryptography -- from the fundamentals to commercial and military-grade ciphers. Not only will you understand what happens "under the hood", but you'll know the difference between major encryption algorithms, and have better insight into what ciphers are better than others for particular applications.
- Bio: Bob Weiss is the founder of Password Crackers, Inc. and a Defcon Goon. He specializes in Cryptanalysis and has spoken numerous times crypto topics.
- Ryan Linn - "Effective Network Hacking with Metasploit"
- Abstract: Once you've compromised your first box with Metasploit, it's easy to identify how it can make portions of the penetration testing process easier. It takes time and experience to help optimize processes, and this workshop will help pen testers who already have a basic familiarity with Metasploit get faster results using the built-in database, basic scripting, and using modules that aren't part of the standard on-line demos. After 2.5 hours, you should have a handful of effective tips that will make your next test flow better and achieve better results in a shorter period of time.
- Bio: Ryan Linn is a Senior Consultant with Trustwave's SpiderLabs -the advanced security team focused on penetration testing, incident response, and application security. Ryan is a penetration tester, an author, a developer,and an educator. He comes from a systems administration and Web application development background, with many years of IT security experience. Ryan currently works as a full-time penetration tester and is a regular contributor to open source projects including Metasploit and BeEF, the Browser Exploitation Framework.
Newbies (25 Min Minute)
- Anthony Kasza - "Proactive Defensive Security Prescriptions"
- Abstract: This talk intends to describe the design of a system which communicates active threats between individual HIDS. By communicating knowledge about malicious sources, analogous systems can proactively defend themselves from known bad actors. The system is built using Trend Micro�s OSSEC and the Linux BASH.
- Bio: Anthony Kasza is an Internet security enthusiast and
packet junkie.
- PhreakingGeek - "Y U NO Sanitize bro?"
- Abstract: Many people use eBay as a means of purchasing low priced tech gear, more times than not the gear that's being sold is coming
from somebody upstream (directly or indirectly) with a much bigger budget. How does that gear get to eBay? What happens when
your corporation uses a recycling company to get rid of parts your infrastructure? This will be a quick look into what
happened when I purchased a switch off of eBay with a bad PSU. As always the config had not yet wiped amongst multiple other
mistakes... Using what we have we will quickly run through how somebody of a less discerning background may exploit every
bit of the haphazardly provided information. More specifically... we will use "OSINT" to map out who the seller is and run
through a scenario of having him lead us to his storage locker full of recycled hardware so we can steal it and potentially
more of the secrets that are hiding on this gear.
- Bio: I like turtles, Malware's pretty cool too.
|