|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 | Google to Pwnage in 60 minutesSpeaker(s): Jayson Street
Google:
* v. To search for a term or terms using the Google search engine.
* n. 1: A highly-used search engine that is considered the most effective on the internet by many. 2: The number 1, followed by 100 zeros.
Pwnage:
* 1. An alternate version of "ownage" derived from .pwn., a common typo for .own.. Term used mainly in online shooters, where one person is displaying superior and winning traits.
* 2. The act or state of perpetrating fierce and unholy domination against another, typically in a videogame setting but also applicable to system hacking, resulting in shame and embarrassment for the victim and his/her family until the end of time.
The Internet itself contains the very tools needed to attack your systems when you connect them to it. This presentation gives you an over the shoulder perspective as a network is attacked using freely available resources. You will get to watch as the same tools and techniques hackers use every day are applied systematically. You will see a hacker go from a simple Google search to an "owned" network in less time than an episode of "24". This presentation will walk through the two phases of network discovery and the three phases of network compromise. The process of reconnaissance and scanning will be demonstrated. Next, you will see how a network is actively explored and exploited. Finally, you will watch the process as an attacker expunges any evidence of his presence. Attacks happen every day. Millions of dollars are stolen, lives are harmed, and reputations marred. This is your chance to look over the shoulder as the hacker works and explains how it is done. You have heard the buzzwords and jargon, now watch it done in real time.
Definitions can be found at the Urban Dictionary. http://www.urbandictionary.com
|  Oct 9th |
|
| Reverse Engineering Security PatchesSpeaker(s): Tim Elrod
This talk is a in depth look at the process of reverse engineering a security patch to determine exploit vectors with the end result being a working exploit for the vulnerability. The talk begins with an overview of the process and motivation behind not only reverse engineering but vulnerability discovery in general. We then delve into the world for RCE (Reverse Code Engineering) with a look at the tools used by reverse engineers as well as some of the techniques employed. the talk ends with a live demo of reversing a QuickTime security Patch resulting in a full working exploit for the vulnerability. The purpose of this talk is to educate people on this often vague practice of reverse engineering in the hopes that they will take adequate steps to improve corporate patching policies.
|  Oct 9th |
|
| The Common Vulnerability Scoring SystemSpeaker(s): John Hale
The Common Vulnerability Scoring System (CVSS) is designed to standardize the evaluation and representation of information technology vulnerabilities. In this capacity, it provides a common framework for characterizing the universal, temporal and environmental aspects of system vulnerabilities. This talk presents an overview of CVSS, describes its history, outlines its relevance to digital enterprises, and offers guidance on its intelligent application to corporate environments.
|  Oct 9th |
|
 | "If a network falls in the Internet does it make a sound?" (The top 5 threats you don’t hear enough about.)Speaker(s): Jayson Street
With so much media attention given to laptop theft, stolen identities and spam you have to wonder what else is happening on the World Wide Web. Jayson pulls the curtain away from the dark side of the internet to give more information on the threats that are emerging and the ones that have been there but silently lurking and continuing to do harm.
| Oct 10th |
|
| COMikazi - The automated ActiveX fuzzing and Exploitation FrameworkSpeaker(s): Tim Elrod
COMikazi is a tool that will fuzz activeX controls for common vulnerabilities and if found will automatically generate metasploit exploitation modules for those vulnerabilities. Combined with a webcrawler to find new ActiveX controls this represents a significant step forward in the field of automated vulnerability discovery and exploitation.
| Oct 10th |
|
| Data Security - Is your data out of control?Speaker(s): Alex Pezold
Information protection is no longer an option; it is a requirement. As networks become more complex, so does the opportunity for serious security incidents. Data Security addresses the need for companies to thoroughly understand their business processes in order to appropriately protect their data. Without having a good understanding of how your company creates and uses data, IT security departments often find themselves applying incorrect controls or inappropriate levels of controls. Through Data Security initiatives such as Data Classification, Data Analysis, and Data Leakage Protection/Prevention, companies will enhance their understanding of the types of data their company needs to protect and how to protect it, while still enabling employees to efficiently function on a day to day basis.
| Oct 10th |
|
|
|
|
|
|
|
|
|
|
|
 |
|
|
|
|