Network scanners are a valuable resource in the security practitioner.s toolkit. They are used to actively probe a network in order to generate a snapshot of the current environment. However, they are not without limitations; they can be loud, resource intensive, and the results can be quickly outdated. During this presentation I will discuss how a passive scanner can be used to identify network traffic.

Passive Asset Detection System (PADS) was designed to supplement active scanners ...
Read More >>

For some silly reason, people commonly think that libraries like "libpcap", "libdnet", and libnids" are difficult to use, yet they're not. developing skills with these libraries and combining them with "libevent" allows you to develop many networking tools and widgets such as scanners, sniffers, and other recon toolkits. this talk will introduce these libraries and show how they can be combined using event driven programming paradigms. the developm...
Read More >>

People who are interested in maintaining situational awareness often deploy honeypots. However, there are whole classes of attacks for which honeypot devices are not very useful, due to their passive nature.

Honeyclients are client-based applications that actively seek malicious servers to gather data for further analysis. This talk will focus on honeyclients, how they can be used, and will share interesting data that has been gathered with a honeyclient. As part of this presentation,...
Read More >>

Users on the internet are doing more and more of their daily work over peer-to-peer applications. Existing protocols such as SMTP and IRC are being replaced by peer-to-peer file transfer, voice chat, and text messaging systems. Unfortunately, the popular protocols are not secure, and the secure protocols are not popular.

In this talk, we will talk about the security properties of the existing peer-to-peer systems, as well as describing an open-source system in development, CUTLASS. CU...
Read More >>

One of the most common examples of reverse engineering is malicious code analysis. In order to clean up after, and prevent further infection by a piece of malicious code, it must be analyzed. Such analysis is often used for generating IDS signatures, detemining exploits used (and hence which patches would be required) and writing detection modules for antivirus software. Usually, this must be done in as little time as possible.

This presentation will cover two examples of popular Wind...
Read More >>

This presentation aims at showing WiFi trafic injection applications in order to practically demonstrate weaknesses of commonly deployed WiFi environments, aka WEP or open networks such as hotspots, for network itself and also for stations connected to it. A practical point of vue is adopted instead of giving another "WiFi is insecure" theorical brief.

The first part will briefly present 802.11 basics so everyone can understand the whole stuff (management vs. data, how injec...
Read More >>

Proximity cards' are commonly used as high-tech replacements for magstripe cards or metal keys: you hold the card within a few inches of the reader, and the door clicks open. They are interesting because they are routinely used to control access to property or services. These cards contain electronic circuitry that authenticates them to the reader using a radio link.

Many such systems are designed with no security at all. This means that the only barrier to entry is the complexity...
Read More >>

Process Stalking® is a term coined to describe the combined process of run-time profiling, state mapping and tracing. Consisting of a series of tools and scripts the goal of a successful stalk is to provide the reverse engineer with a intuitive interface to run-time block-level trace data.

The Process Stalking suite is broken into three main components; an IDA Pro plug-in, a stand alone tracing tool and a series of Python scripts for instrumenting intermediary and GML graph files. The...
Read More >>

This paper proposes a new technique for hardening registration number protections by using multithreaded Petri nets. Using this technique one is able to prevent reverse code engineering attacks, which consist of protection scheme analysis and reengineering. We come to the conclusion that using such a technique leads at minimum to an enormous reverse code engineering and analysis process for the attacker and that the proposed technique is therefore an amelioration in registration number ...
Read More >>

Like a skilled native, the able seeker has become part of the web. He knows the smell of his forest: the foul smelling mud of the popups, the slime of a rotting commercial javascript. He knows the sounds of the web: the gentle rustling of the jpgs, the cries of the brightly colored mp3s that chase one another among the trees, singing as they go; the dark snuffling of the m4as, the different sounds and the rustling of the databases, the pathetic cry of the common user, a plaintive cooing ...
Read More >>