DAY 1 (7th July 2009)

TIME	TOPIC	SPEAKER
0830 - 0900	報到
0900 - 0930	開幕致詞	Thomas Lim Organiser, SyScan'09, CEO, COSEINC
0930 - 1000	開幕致詞	Wayne Huang CEO, Co-Founder ArmorizeTecnhnolgies
1000 - 1030	Coffee and Tea Break
1030 - 1130	CLOUDBURST Recently Immunity researcher Kostya Kortchinsky has exploited a serious vulnerability in VMWare's hypervisor that allows Guest to Host escaping. During this presentation Kostya will explain the vulnerability primitives, how to combine these primitives into a reliable exploit that bypasses EP/ASLR, how to make that exploit reliable across Linux, Windows XP, and Windows Vista, and how to obtain post-exploitation control of the host without any network access. This extremely technical talk will delve into the detailed workings of a highly complex exploit and discuss the development process in a rare level of depth.	Dave Aitel CTO, Immunity
1130 - 1145	Break
1145 - 1245	如何利用Ruby來Fuzzing二進位檔案找出微軟作業系統漏洞 Finding Microsoft Office Vulnerabilities by Fuzzing Binary Files with Ruby While a lot of public material is available that _mentions_ fuzzing Office files, there is very little detail. While I have been dealing mainly with Word, the bulk of the techniques are applicable to any Office application. I plan to cover: Reading and writing "streams" in the OLE "compound binary file" format Recognising and parsing interesting structures in the Word Binary Fileformat Highlights / 'errors' from the specification documents Instrumenting Word with Win32OLE to automate the testing - Did it crash? Is the document sitting there open, wasting testing time? Lightweight and totally flexible runtime monitoring by automating CDB with ruby (what good's a crash without the details?) Dialog Boxes You Will Meet that will hang your fuzzer thread and How to Eliminate Them Turning off annoying Word 2007 Resiliency features and other ways to reduce registry bloat Where Word stores its bizarre, invisible temp files (which don't get deleted if it crashes) Dealing with hangs and memory eaters. Wrapping the whole lot up in a distributed fuzzing framework to spread the fuzzing load over as many client machines (or VMs) as you like, save all the results in a DB and even use other frameworks or languages to create test cases Doing the whole lot in Ruby, because nobody else has, yet. (at least nobody who has released their code)	Ben Nagy Sr. Researcher, COSEINC
1245 - 1400	Lunch
1400 - 1500	Apple iPhone手機安全 Hacking iPhone – Fuzzing and Payload This talk will briefly introduce the the iPhone security architecture. It will then demonstrate how to perform automated fuzzing on the device including SMS fuzzing. It will then demonstrate some payloads for the iPhone. iPhone payloads are complicated by the fact that on factory phones, no pages can be made executable. Therefore, the payloads consist of long chains of return-to-libc.	Charles Miller Independent Security Evaluator
1500 - 1515	Break
1515 - 1615	"Did They Break WiFi?"	Cedric Blancher EADS
1615 - 1645	Coffee Break
1645 - 1745	阿碼科技X-Solve實驗室首席研究員 To be update soon...	Jeremy Aka Birdman Armorize Technologies
	End of Day 1

DAY 2 (8th July 2009)

TIME	TOPIC	SPEAKER
0900 - 1000	To be update soon To be update soon	Fyodor Yarochkin
1000 - 1030	Coffee Break
1030 - 1130	專精應用程式安全，著重於Web應用程式之滲透測試，code review，以及安全的程式開發原則 Living in the Rich Internet Application (RIA) World – Blurring the line between Web and Desktop Security This talk gives an overview of the security of emerging Rich Internet Application (RIA) technologies. Because these technologies are so new, little information is currently available on their security or lack thereof. This talk will provide attendees with an in-depth look into the security of leading RIA technologies, as well as the security concerns presented by the RIA paradigm itself.	Justine Osborne iSEC Partners
1130 - 1145	Break
1145 - 1245	專精無線與有線網路安全，資安鑑識，資安稽核以及 active networking等技術 RFID attacks without end - IT runs that`s enough This talk will give an overview of all existing RFID Attacks, Mifare, ISO 15693 and more. Special focus will be on EPC Tags, a demonstration how to clone and attack GS1 EPC Tags will be Demonstrated as well. EPC RFID are Tags that operate in the UHF Frequency band and is used for Logistics in private as well military sector. Benefit: The user will get a technology background on RFID, as well show how to attack the different layer (Air, Data, Backend) of RFID solutions.	Lukas Gruwald RFID Hacking 祖師 CTO
1245 - 1400	Lunch
1400 - 1500	State of the Art Post Exploitation in Hardened PHP Environments When an attacker manages to execute arbitrary PHP code in a web application he nowadays often ends up in hardened PHP environments that not only make use of PHP's internal protections like safemode, openbasedir or disable_functions but also make use of Suhosin and operating system, filesystem or libc level security mechanisms like ASLR, NX, hardened memory managers or unix file permissions. In such a situation taking over the server becomes a challenge and requires PHP shellcode that is able to use local PHP exploits to get around these protections. This talk will show the problems arising from the different protection mechanisms for PHP shellcode, will give an insight into the internal memory structures of PHP that are required to write stable local exploits and will demonstrate how a special class of vulnerabilities in PHP that also exists in standard functions enables PHP shellcode to get around most of these protections.	Stefan Esser PHP安全第一人
1500 - 1515	Break
1515 - 1615	Reconstructing Dalvik Applications (Google Android) The virtual machine for running the majority of userland applications within Google's Android machine is called "Dalvik". It is a natural successor of the Java VM, improving design and footprint for mobile application scenarios, by avoiding the overhead of Java ME. Although Google chose to use the java toolchain to generate applications, they designed a new compiled representation of the compiled applications, compared to java with different stack semantics and a denser instruction set (imho, java done right:)). For reverse engineering until now you could either learn Dalvik bytecode or bribe the original author to give you access to the source code. Both approaches do not deliver fast and readable results, so our "undx" (dx is the java-to-dalvik compiler) provides reverse engineers and software auditors, as well as virus checking software a reliable technique to process dalvik code by translating those back to Java classes, which opens the opportunity to re-use established tools and techniques from the java world for analysis. Our entire code was created without code knowledge of any Dalvik code internals. For our purpose we solely studied the output of the binary "dexdump" tool and used a decent hex editor to discover helpful structures within the binary. We will present the following: The dalvik architecture (compared to Java SE) The dalvik instruction set and runtime layout (compared to Java VMs) A short excourse: Manual decompilation Presentation of an automation approach towards java class recovery Insights of the implemented converter Coding hurdles, caveats (we currently create 95% verifiable java classes) Further work, further application potentials within the reverse engineering and software testing areas.	Marc Schoenfeld BlackHat
1615 - 1700	抽獎活動 ─Wii , X360, Sony PS2幸運得主就是你！Prize Presentation and Lucky Draw
	End of SyScan'09 Taipei