DAY 1 (16th December 2004)

TIME	TOPIC	SPEAKER
0800 - 0845	Registration
0845 - 0900	Welcome and Opening
0900 - 0945	OPEN SOURCE VULNERABILITY DATABASE The Open Source Vulnerability Database (OSVDB), a project to catalog and describe the Internet's security vulnerabilities, opened for public use on 31 March 2004. The OSVDB project was launched in 2002 following a realization in the security community that no independent, community-operated vulnerability database existed. There were, and still are, numerous vulnerability databases. Some of these databases are managed by private interests to meet their own requirements, while others contain a limited subset of vulnerabilities or have significant restrictions on their content. None are simultaneously comprehensive, open for free use, and answerable to the community. This talk will focus on the successes of the project to date as well as many new developments that are underway, including the ability to provide active integration to help improve and analyze open source security tools.	Jake Kouns
0945 - 1030	EXPLOITS MITIGATION TECHNIQUES OpenBSD has been auditing software for nearly 10 years, and while we have had significant success, it is clearly not enough. In the last 3 years a new view on preventing attacks has surfaced in the mindset of our group. A software exploit author starts by finding an interesting bug. Writing an exploit is easy because he can rely on a variety of system behaviours, which are very deterministic. Many of these behaviours are not required for proper operation. Recently we have developed many new techniques, which combine to thwart the attacker, without affecting regular software. We make the Unix process environment difficult to attack much like filling a house full of a variety of burglar traps.	Theo de Raadt Project Leader, OpenBSD
1030 - 1100	Coffee Break
1130 - 1145	Network Forensic N/A
1145 - 1230	THE ART OF DEFILING: DEFEATING FORENSIC ANALYSIS ON UNIX FILE SYSTEMS The rise in prominence of incident response and digital forensic analysis has prompted a reaction from the underground community. Increasingly, attacks against forensic tools and methodologies are being used in the wild to hamper investigations. This talk will: familiarize the audience with Unix file system structures; examine the forensic tools commonly used, and explore the theories behind file system anti-forensic attacks. In addition, several implementations of new anti-forensic techniques will be released during the talk. Anti-forensics has cost the speaker one job. This material has never been presented in the North American continent because anti-forensics scares the feds. Find out why	The Grugg
1230 - 1315	ABOUT SHELLCODE In this presentation we will see why and how to make unix shellcodes, the different programs that exist, the different shapes we can give to them, from raw binary to ascii only, and the different things we can have them do, from simply exec'inc /bin/sh to complex loads that can jump from one process to another.	Philippe Biondi
1315 - 1400	Lunch
1400 - 1445	SYNSCAN - NEW TOOL FOR OS FINGERPRINTING OS fingerprinting, both passive and active, has many uses in network security, forensics, and intrusion detection and prevention. A new tool, SYNSCAN, has been developed to make OS fingerprinting more accurate by providing more information about the remote network stack implementation. Greg will be describing this tool and it's applications in network security and specifically for uses with intrusion detection and prevention.	Greg Taleck
1445 - 1530	NETFLOW BASED NETWORK SECURITY ANALYSIS Up until recently, security measures have been enforced at the perimeter, while ubiquitous deployments of remote access links and wireless networks were eroding the network boundaries thus defined. Recent worms history has clearly demonstrated the fact that the threat is now in the inside, and that the border defenses are getting circumvented. As this trend is not going to fade away, large networks must be somewhat domesticated to permit monitoring. While Network Flow data, as exported by routers, were designed for accounting, they represent an efficient way to record transactions occurring on a network for real time or forensic analysis. This talk will focus on the security applications of Network Flows, and how they can be used to detect and analyze network misuses in corporate and service providers' networks.	Yann Berthier
1530 - 1545	Tea Break
1545 - 1630	STORAGE SECURITY: SECURITY THREATS AND BEST PRACTICES FOR FIBRE CHANNEL SANS The presentation will be a formal knowledge transfer session to discuss tactical methods and high-level strategies to adequately secure storage infrastructures. The presentation will begin with a discussion on the several security issues associated with Fibre Channel Storage Area Networks (SANs). The session will highlight specific issues and flaws associated with storage and how attacks may expose critical vulnerabilities. The session will then progress to a discussion on the tactical methods and strategies to mitigate identified security problems. The presentation will cover three to five security topics and specifically discuss a tactical solution for each of them. The standard and best practices discussed in the session will focus on authentication/authorization, segmentation, device configuration (lockdown), auditing/logging, and encryption. Each topic will be discussed along with a tactical security solution to fully describe the defensive measures that can protect against storage attacks. Lastly, the session will highlight the effects of default settings on networks storage devices, such as SAN switches, which can negatively impact the security osture on storage infrastructures.	Himanshu Dwivedi Regional Director, @Stake
1630 - 1715	WINDOWS KERNEL EXPLOITATION The presentation will highlight mechanisms to exploit the Windows Kernel for useful local privilege escalation. Unlike "Shatter Attack" which usually only useful if attacker has physical access of the computer, Kernel exploitation will escalate the attacker to the highest level as the kernel itself without any restriction. The presentation will include usage of undocumented API, memory corruption on device driver, kernel 'shellcode' as well as other relevant tricks to find and exploit the Windows kernel-land for a successful privilege escalation.	SK CHONG SCAN ASSOCIATES
	End of Day 1

DAY 2 (17th December 2004)

TIME	TOPIC	SPEAKER
0900 - 0945	NETWORK FIRELINES The traditional network perimeter defense of firewalls and IDS is intended to restrict unwanted network activity from entering or exiting the corporate network, but it falls short as a reliable defense for larger business networks. Secondary defenses, or Firelines, can be utilized by network security firefighters to improve the overall defense of the corporate network. This talk will discuss several strategies and methods devised to identify and respond to internal threats, anomalies, and misconfigurations without the use of traditional IDS or Firewalling methods.	Paul Watson
0945 - 1030	BUILDING AN EARLY WARNING SYSTEM IN A SERVICE PROVIDER NETWORK Service Provider networks and systems are, by definition, a forced point of transit for most of the attacks we see nowadays on the Internet. Combining data from exposed systems (like DNS and SMTP servers), BGP updates, Netflow accounting, uRPF, ACLs and interfaces counters helps to build a network's behaviour baseline and to detect activities like DDoS attacks, worms, covert channels, hacked systems, open proxies, etc. This can even be compared to a high bandwidth, distributed, low-cost IDS. To improve the quality of the anomaly detection one can add sensors in the network, mainly composed of low-interaction honeypots and sinkholes. Additional deployments, like honeybots (running DDoS zombies in a sandbox to gather attack data) and honeyrouters (to catch BGP speaking routers hunters) are more resource intensive but broaden the scope of the EWS. Such an approach is not CAPEX/OPEX intensive, and comes with nearly zero impact on the infrastructure thanks to the re-use data and statistics that are already available from monitoring, security and management systems. When combined with real-time traffic diversion techniques the macroscopic (high level flows and anomalies) view can become a microscopic one (full header and payload). Most of these concepts and ideas also apply to internal IT networks and can be really helpful when it comes to detect rogue activities like worm breakouts or unusual traffic flows.	Nico Fischbach
1030 - 1100	Coffee Break
1100 - 1145	RELIABLE WINDOWS HEAP EXPLOITS N/A	Matt Conover
1145 - 1230	PHREAKING: PAST, PRESENT AND FUTURE Before hackers became a media fixture, there was a time when phreakers were all the rage and abusing CCITT#5 phone switches was open to anybody with a blue box. As most Telcos upgraded their equipment to support the new, out-of-band, digital SS7 signaling protocol, blue boxing was slowly but surely phased out. Phreakers went legit or quiet. The Internet and its lot of script kiddies became the center of interest. Is phreaking dead? We beg to differ! This presentation will focus on advanced phreaking techniques for the 21st century warrior. After a short presentation of current digital telecommunications network (with a focus on GSM/GPRS/EDGE and CDMA/3G) we will study how each element can be compromised for fun and profit. Nothing will be left untouched: Core Switching Radio Networks GPRS infrastructure 3G data Messaging Roaming Fraud management Customer care systems Billing systems Mediation systems WAP servers Intelligent Network services Legal interception gateway Signaling devices Content aggregators Network Management Systems	Emmanuel Gadaix
1230 - 1330	Lunch
1330 - 1415	INFORMATION SECURITY IN BANKING: THE ILLUSION OF SAFETY This presentation will focus on ways to defeat a bank's security by ways of deception, taking advantage of specific subtleties in human behavior and the bank's network of trust. This session will include three real-life case studies: Penetration testing major Asian banks; the speaker will show why most security mechanisms can give a false of safety and demonstrate how an attacker can ensure "rapid ownership" of the most "up to date", "patched" and "secure" systems without using a single 0 day exploits. Auditing the security of core banking systems. The speaker will give real examples of insider hacking and fraud (erasure of loan files, manipulation of interest rate and foreign exchange data, vendor tempering with production environment, ATM backdoors, bypassing AS/400 security, etc. Finally, the speaker will present the results of his Jakarta/RI Wireless Security Survey 2003 and 2004 including disturbing screenshots of ATM transactions and multi-million dollar wire transfers which broadcasted in clear text over wireless networks without the bank's knowledge.	Anthony Zboralski
1415 - 1500	NETWORK SITUATION AWARENESS Fine young gentleman of monkey.org humbly presents a free suite of tools to be used in concert or individually to provide a highly integrated view of the network, its participants, their peculiarities, conversations, and interactions.	Dug Song
1500 - 1530	Tea Break
1530 - 1615	THE SURPRISINGLY COMMON NTLM AUTHENTICATION PROTOCOL AND ITS WEAKNESSES This talk examines NTLM as a mechanism for network authentication and discusses why it has been slow to be phased out despite known weaknesses and the release of NTLMv2. I will then present my results on NTLMs resistance to active attacks, including precomputed dictionary attacks, and middle person attacks. I will discuss aspects of its structure, its relationship to the broken DES cipher, and how the storage of it's authenticators represents a poorly understood security threat. I will demonstrate some tools, which validate the attacks I am discussing, and practical solutions for working around NTLM authentication in either a Windows or SAMBA environment.	Jesse Burn
1615- 1700	FORUM - "CERT AND SECURITY OPERATION CENTERS - ARE THEY USEFUL?" Discussion Panel: Solahuddin bin Shamsuddin - Head of MyCERT Martin Khoo - Head of SingCERT Anthony Zboralski - Founder of HERT
	End of SyScan'04