DAY 1 (1st September 2005)

TIME	TOPIC	SPEAKER
0800 - 0830	Registration
0830 - 0845	Welcome and Keynote Speech	Dr. Thaweesak Koanantakool Director, National Electronic and Computer Technology Center Thailand
0845 - 0915	Responsible Disclosure	Microsoft
0915 - 1015	Security Tools Integration Framework: Automating Distributed Hacking Coordinated Network Intrusions is not an easy thing to handle. Automated Coordinated Network Intrusions could be even greater mess. A tool-human gluing framework, STIF, has evolved and developed into a coordinated intrusion intelligence management system. Now to be released with further enriched functionality, data publishing interface (including SQL, plain text, and TCP/IP socket interfaces) , multiple user interfaces (including web front-end and an IRC bot), pluggable architecture (plug and play your favorite tools ;)).	Fyodor Yarochkin and Meder Kydyraliev
1015 - 1030	Coffee Break
1030 - 1130	Auditing Unix Kernel Code This talk will focus on manual inspection of kernel code when available and fuzzing kernel bugs in closed source operating systems by using common sense. The presenters will tell the audience what to look for and where to look, and they will be shown some rather interesting examples. Some of the issues that will be handled are: stack overflows Heap overflows Integer overflows & signedness issues Race conditions (missing locks, ...) Information leaks It is expected that the audience has some (limited) experience with these attacks and has some basic understanding of operating system internals. Examples will be taken from Linux, Mac OS X, Free- and OpenBSD.	Ilja van Sprundel Suresec.org
1130 - 1200	Security Threats, Insecure Protocols and Common Vectors N/A	Jason Pearce Cisco Thailand
1200 - 1300	Lunch Break
1300 - 1400	Social Engineering Fundamentals "You might say there are two specialties within the job classification of con artist. Somebody who swindles and cheats people out of their money belongs to one sub-specialty, the grifter. Somebody who uses deception, influence, and persuasion against businesses, usually targeting their information, belongs to the other sub-specialty, the social engineer." -Kevin Mitnik In today's world confidence scams present quite possibly the highest threat to security with in the business world. Control of information, withholding and leaking, can lead to massive failures and losses depending on how skilled the attacker may be. In combination with disinformation and propaganda, social engineering can as fatal as or even lead to loss of customer and shareholder confidence.	Dave McKay and Anthony Zboralski
1400 - 1500	iSCSI Security; Insecure SCSI iSCSI is insecure. SCSI calls have traditionally been used from an IDE hard drive to the motherboard (the grey ribbon inside your computer). iSCSI takes all the benefits of SCSI and the connectivity of IP to provide large volumes of storage dynamically to any machine, any time, over any IP network. While iSCSI brings a tremendous amount of connectivity benefits, it simply has ignored security. Any protocol or product that controls large volumes of critical data should strongly support the core principles of security, including authentication, authorization, and availability. Unfortunately iSCSI does not support these aspects very well nor does it enable many of these principles by default. Furthermore, vendors like Microsoft, Cisco, NetApp, and EMC are pushing iSCSI into the market, but are failing to address the security issues that their customers will face. The iSCSI Security presentation will contain three specific sections to educate users about the drastic security problems that are being overlooked with iSCSI storage. The presentation will include an Introduction/Protocol Overview, a description and demonstration of iSCSI Attacks, information on the iSCSI Defenses for each attack identified, and a short Conclusion. The presenter will described the security weaknesses, issues, and exploits concerning authentication and authorization and will follow-up each discussion with a demonstration of the actual attack. iSCSI attacks will show how 300 gigabytes of data can be compromised over the IP network without a single username of password. The attack demonstration will show how application and operating system security is important, but should not overshadow storage devices. The demonstration will also show that a compromise of a storage device can be equal to compromising 10 to 20 applications and/or operating systems combined, both of which are accessible over the IP network.	Himanshu Dwivedi iSecPartners
1500 - 1530	Coffee and Beer Break
1530 - 1630	Speaking freely: the security and privacy challenges of modern communications "The telecommunications landscape is undergoing multiple revolutions, from analog to digital, from simple mobility to complex roaming, from TDM to VoIP, from centralized to distributed, from proprietary systems to open standards and more importantly, from a closed environment to an increasingly interconnected world. Those changes are creating new security challenges, and the battle between privacy advocates and law enforcement is far from being over. As legal interception techniques become more ubiquitous, solutions to counter them such as cryptography and distributed non-standard protocols, are increasing in popularity. Similarly, hacking techniques and countermeasures for the new communications protocols such as VoIP, 3G/4G, IMS, WiMAX and others, are gaining in complexity and are becoming a growing concerns for authorities, operators and subscribers alike."	The Grugq Emmanuel Gadaix - Telecom Security Task Force
1630 - 1730	Infecting the Mach-o Object Format This talk aims to dispel the myths surrounding Mac OSX regarding it's ability to stand up to viruses and malicious code. The talk would begin with an introduction to ppc architecture, showing a few basic assembly instructions, then go into an overview of the mach-o format. Following this i would run through a few methods of infecting mach-o files which i have worked on recently, showing C based proof of concepts for these. I would also look at hooking functions and stealing arguments and some mach-o specific anti debug method. Finally i would finish up with a conclusion about the likelihood of infection on OSX showing possible attack vectors etc.	Neil Archibald Suresec.org
1730 - 1830	HoneyPot Forensic In the world of intrusion detection, intrusion prevention and hacker research honeypots are a quite a new and interesting technology. But only few know there is more to achieve with honeypots than just catch an intruders attention. Honeypots could reward you with versatile results and this presentation will be interesting to you even if you are familiar with deploying IDS/IPS/Honeypot systems. We will give an overview of the existing tools and provide you with a methodology to start your own forensic examinations.	Krisztian Piller and Sebastian Wolfgarten
	End of Day 1

DAY 2 (2nd September 2005)

TIME	TOPIC	SPEAKER
0800 - 0900	Attacking Web Services Web Services represent a new and unexplored set of security-sensitive technologies that have been widely deployed by large companies, governments, financial institutions, and in consumer applications. Unfortunately, the attributes that make web services attractive, such as their ease of use, platform independence, use of HTTP and powerful functionality, also make them a great target for attack. In this talk, we will explain the basic technologies (such as XML, SOAP, and UDDI) upon which web services are built, and explore the innate security weaknesses in each. We will then demonstrate new attacks that exist in web service infrastructures, and show how classic web application attacks (SQL Injection, XSS, etc..) can be retooled to work with the next-generation of enterprise applications. Strategies for properly designing and protecting web service enabled applications will also be discussed. The speaker will also demonstrate some of the first-time publicly available tools for finding and penetrating web service enabled systems.	Alex Stamos iSecPartners
0900 - 1000	Attacking WiFi N/A	Cedric Blancher EADS Corporate Researcher Center
1000 - 1015	Coffee Break
1015 - 1115	Profiling Rootkits and Malware through Executive Objects This talk will focus on a new method to profile user-mode and kernel-mode activity by hooking executive objects in the Windows kernel. It is a nice alternative to traditional API hooking and can be used to detect all current rootkits. Virtually all important operations in Windows are associated with an executive object--be it drivers, devices, files, sockets, registry keys, etc. By hooking these objects, we can observe the behavior of the kernel or user-mode application at a very low level, making it far more difficult for malware/rootkits to hide.	Matthew "Shok" Conover Symantec
1115 - 1215	Attacking Internet Banking Applications The general public sentiment is that the banks, having always been the guardians of our money, are expert at safeguarding it. Unfortunately, internet corporate banking and personal banking applications are usually ridden with bugs. Internet Banking Applications development is nowadays out-sourced to third party software vendors that have poor understanding of security, and incomplete quality management processes. Most of the time the applications are extremely insecure before they get audited by security professional third-parties. This presentation will demonstrate the various attacks that almost always work (and those that do not), on your �bank-next-door� internet banking application, illustrated with real life statistics. We will outline the regular technical attacks and will focus on a hit parade of business logic attacks. We will steal money from other customers, buy shares for free, and spy on other customers bank records among many other frauds. This demonstration will highlight the solutions to some of the challenges the banks will face online to ensure that their data handling practices are compliant with their country�s privacy regulations and banking regulations among others.	Fabrice Marie FMA-RMS
1215 - 1315	Lunch Break
1315 - 1415	Exploiting kmalloc overflows to own j00 This talk will focus on a mechanism to exploit the Linux kernel for local privilege escalation. We will start off discussing the internals of the Slab Allocator, followed by an overview of possible exploitation techniques that we have researched. Lastly, we will end the presentation with a case study of a 0day exploit for a Linux kernel integer-related vulnerability.	Clflush and Amnesia Kernsh Security Research
1415 - 1515	Bluetooth Hacking-Full Disclosure In November 2003, Adam Laurie discovered serious flaws in the authentication and data transfer mechanisms on some Bluetooth enabled devices, and, in particular, mobile phones including commonly used Nokia, Sony Ericsson and Motorola models. Shortly thereafter, Martin Herfurt of Salzburg Research Forschungsgesellschaft mbH expanded on these problems, and teamed up with Adam to investigate further. At EuroFoo in August 2004, Adam and Marcel Holtmann met, and agreed to collaborate on looking into the underlying causes of the problems, as well as sharing information and resources to try and gain a better foothold for the Open Source community within the official Bluetooth organizations. This talk will cover the issues arising out of the flaws, as well as the actual stack methodologies and tools used, and an update on the industry's response and progress since the original discoveries. This will be a fun talk and a real eye-opener for those with Bluetooth enabled devices, and will start with an introduction into the Bluetooth architecture and the security mechanisms offered by it so that it is possible to understand how and why the different attacks are working. Further there will be an introduction into the Linux Bluetooth stack BlueZ that will be used for doing the attacks and showing exactly how these attacks are working.	Adam Laurie The Bunker Secure Hosting
1515 - 1545	Coffee and Beer Break
1545 - 1645	.Net Web security-Attack and Defense Web security is becoming very critical as .Net framework is evolving. New set of vulnerabilities are coming up at web application level. Web Services are also becoming integral part of web application and creating next generation threat for emerging web application layer. There are new set of methodology is required to attack .Net applications and to provide defense new strategies are evolving. This presentation will brief about both attacks and defense with new set of tools.	Shreeraj Shah NetSquare
1645 - 1745	Hacking Window CE N/A	SAN XFocus
1745 - 1845	Old Skewl Hacking-Infrared - How to Break into the Hotel System "The telecommunications landscape is undergoing multiple revolutions, from analog to digital, from simple mobility to complex roaming, from TDM to VoIP, from centralized to distributed, from proprietary systems to open standards and more importantly, from a closed environment to an increasingly interconnected world. Those changes are creating new security challenges, and the battle between privacy advocates and law enforcement is far from being over. As legal interception techniques become more ubiquitous, solutions to counter them such as cryptography and distributed non-standard protocols, are increasing in popularity. Similarly, hacking techniques and countermeasures for the new communications protocols such as VoIP, 3G/4G, IMS, WiMAX and others, are gaining in complexity and are becoming a growing concerns for authorities, operators and subscribers alike."	Major MalFunction
1845 - 1900	Closing Speech and Lucky Draw	Dr. Komain Pibulyarojana Head of Thai Computer Emergency Response Team
	End of SyScan'05