DAY 1 (13th May 2009)

TIME	TOPIC	SPEAKER
0900 - 0930	OPENING AND WELCOME ADDRESS 开幕致词	THOMAS LIM Organiser, SyScan'09, CEO, COSEINC
0930 - 1030	微软公司产品的弱点:过去、现在、未来 微软公司产品的漏洞议题已持续多年，就像研究员的技术及研究工作一样一日千里。 Immunity公司持续找出微软产品的弱点并提出修正。 这些资料提供新分析工具(例如Immunity Debugger)一个平台，并且使Immunity研究人员不间断研究出新攻击策略。 Immunity将为您报告这些漏洞对策的发展如何变化，以及漏洞研究员如何变通。 Microsoft Products' Vulnerabilities - Then, Now and the Future Security vulnerabilities in Microsoft products have evolved over the years, as have vulnerability researcher's techniques and tool-sets. Immunity reviews all public vulnerabilities, and the updates that fix them. This data provides a platform for the development of new analysis tools such as Immunity Debugger, and it allows Immunity's researchers to continue to evolve new attack strategies. Immunity presents this process, discussing how vulnerability countermeasures evolve over time and the directions vulnerability researchers have to follow as a result.	Kostya Kortchinsky Immunity
1030 - 1100	Coffee and Tea Break
1100 - 1200	如何利用Ruby来Fuzzing二进位档案找出微软作业系统漏洞 Finding Microsoft Office Vulnerabilities by Fuzzing Binary Files with Ruby While a lot of public material is available that _mentions_ fuzzing Office files, there is very little detail. While I have been dealing mainly with Word, the bulk of the techniques are applicable to any Office application. I plan to cover: Reading and writing "streams" in the OLE "compound binary file" format Recognising and parsing interesting structures in the Word Binary Fileformat Highlights / 'errors' from the specification documents Instrumenting Word with Win32OLE to automate the testing - Did it crash? Is the document sitting there open, wasting testing time? Lightweight and totally flexible runtime monitoring by automating CDB with ruby (what good's a crash without the details?) Dialog Boxes You Will Meet that will hang your fuzzer thread and How to Eliminate Them Turning off annoying Word 2007 Resiliency features and other ways to reduce registry bloat Where Word stores its bizarre, invisible temp files (which don't get deleted if it crashes) Dealing with hangs and memory eaters. Wrapping the whole lot up in a distributed fuzzing framework to spread the fuzzing load over as many client machines (or VMs) as you like, save all the results in a DB and even use other frameworks or languages to create test cases Doing the whole lot in Ruby, because nobody else has, yet. (at least nobody who has released their code)	Ben Nagy Sr. Researcher, COSEINC
1200 - 1300	Lunch
1300 - 1400	WEB 应用和数据库安全剖析	Frank Fan 范渊 CTO, 杭州安恒信息技术有限公司
1400 - 1415	Break
1415 - 1515	缓冲环境内执行程式 - 如何分析电子计算机中来历不明驱动程序 Buffered Code Execution version 3 - Analyzing Unknown Loaded Driver in your machine This will demonstrate that we can inject code into a guest virtual machine from the hypervisor. We are able to install a standard Windows driver and invoke an exported function in the driver. It will run within the guest VM at ring 0 and it can interact with the guest in a standard way (use exported NTOSKRNL functions, etc.). It runs under a standard Windows kernel thread. After the function returns, the driver is unloaded and all traces of the driver are removed. The benefit to this design is that we can minimize the chance for malware in the guest to detect or interfere with our in-guest agent to a small window. The in-guest agent is only detectable while it is running. It is intended that the code be relatively small and fast (i.e., used to kill a malware process, apply a code patch, etc.).	Matthew Conover Senior Researcher, Symantec
1515 - 1545	Coffee Break
1545 - 1645	工具的新发展-案例分析 What's new in new xprobe - case studiesXprobe The upcoming version of the tool, which will be released in June, is built on the top of updated scanning engine and includes new set of plugins including application level discovery plugins, path discovery plugins, updated plugin prioritization and signature scoring. the presentation is built on the top of network mapping, analysis and attack investigation case studies that led to development of new features of the tool.	Fyodor Yarochkin
	End of Day 1

DAY 2 (14th May 2009)

TIME	TOPIC	SPEAKER
(A) 0900 - 1230	视窗环境中如何编写 Writing shellcode on Windows A 4 hours workshop, taught by a leading Immunity researcher, that introduces students to the fundamental requirement of preparing exploits for Windows machines: the development of Windows shellcode. Topics covered in this half-day, hands-on session include i386 assembler for shellcode writers, how to use the free tool Immunity Debugger, and the "hello world" of shellcoding: connect-back and execute. Attendees need to bring a laptop already installed with Immunity Debugger (http://www.immunityinc.com/products-immdbg.shtml) and Python 2.5.	Kostya Kortchinsky Immunity
(B) 0900 - 1230	中国骇客如何移民到美国 USA Immigration for Hackers The USA Immigration for Exploit Developers workshop will introduce attendees to the most common visas that vulnerability researchers and exploit developers qualify for, and assist attendees in preparing their own appropriate resumes, application letters, and self descriptions for use in immigration scenarios such as potential employer discussions, Immigration attorney meetings and interviews with USA Immigration officials. The workshop will include presentation and exercise components to make the content relevant to the individual backgrounds of the attendees and to help security researchers become familiar with the process of USA immigration. 实做一： 如果写出对移民有利的履历表 Writing your immigration-friendly resume. The process of translating hacker skills to immigration-friendly job descriptions and resumes can be a challenge for native English speakers - even harder for non-native English speakers! Some visas require descriptive proof of "exceptional ability". Good hackers have exceptional ability, but explaining this in minimally technical and non-threatening terms is not a simple process. 实做二： 鉴定正确的签证： Identifying the right visa. Given sample resumes, we will walk through potential options and strategy for several visa types that can commonly be applied to security researchers. 实做三： 面谈准备工作： Interview preparation. Security researchers starting work in the USA (and the HR Managers that help them get there!) have to answer many questions and prepare a lot of documentation about the researcher's professional background, skill-sets, and employment position. In this exercise, students will practice answering questions in mock scenarios such as USA arrival or consulate interviews. Attendees will learn how to present concepts such as vulnerability research and exploit development in an understandable and non-threatening way that aligns with general directions in the IT industry. The intent of this exercise is to expose attendees to the types of questions that will be asked by Immigration officials, and to be able to prepare accurate responses that reflect the abilities of security researchers in an understandable and appropriate manner. All materials will be supplied.	Dave Aitel CTO, Immunity
1230 - 1330	Lunch
(A) 1330 - 1700	揭开神秘无线区域网路安全面纱 Demystifying wireless security Workshop description: Wireless security has been questioned a lot in the past few months, with multiple, somehow contradictory claims that WPA was broken. As a consequence, it is less and less clear if Wi-Fi can be secured or not, and if yes, how. This workshop will give you a very clear picture of wireless security actual state, comprehensively describing Wi-Fi security mechanisms, as well as limitations, known attacks impacts and mitigation, challenging some claims that have been made. At the end, you will have a clear picture on the efficiency of the available Wi-Fi security feature and the best way to deploy them within your environment. Keywords: Wi-Fi security, WEP, WPA, WPA2, 802.11i, PSK, 802.1x, EAP, TKIP, CCMP, WEP cracking, PSK brute-forcing, TKIP flaw Outline: Security means and limitations WEP WPA/WPA2 Misc. : MAC filter, SSID cloaking, etc. Attacks DoS WEP cracking in 2009 PSK brute-forcing TKIP attack Wi-Fi secure deployment best practises Case studies	Cedric Blancher EADS
(B) 1330 - 1700	网络应用与资料库安全 Web Application and Database Security Workshop In this 3 hours workshop, the following topics will be covered: Web App Vulnerability in Depth Web App Pen-test hands on Oracle Security step by step SQL Server Security Step by step Web App and Database Hardening	Frank Fan CTO, DBApp
	End of SyScan'09 Shanghai