DAY 1 (23rd September 2010)

TIME	TOPIC	SPEAKER
0830 - 0900	REGISTRATION
0900 - 0910	OPENING AND WELCOME ADDRESS	MR. NGUYEN TIEN THANH Director, I. E. T. Co., Ltd
0910 - 0920	WELCOME ADDRESS	THOMAS LIM SyScan'10, COSEINC
0920 - 0930	WELCOME ADDRESS	MR. LE MANH HA Director of Ho Chi Minh City Department of Information and Communications, Ministry of ICT
0930 - 1030	DETECTING MALICIOUS DOCUMENTATIONS Nowadays, people are well-aware of malware in executable format such as EXE, and they can protect themselves with defense solutions such as anti-virus (AV). However, modern threats come from malicious files such as PDF, DOC, PPT, XLS, etc... The attacker can embed malware into any type of electronic documentations, and the victim will get exploited once he opens these files with unpatched, vulnerable applications. Unfortunately, this attack vector is increasingly popular, and it is extremely hard to know if a documentation is poisonous, especially if the attacker uses 0-day bugs. The situation is even more frustrated because current AV softwares badly fail against this upcoming malware. This paper presents a novel tool named D-Analyzer to detect malicious documentations. Using tainting analysis method, our tool is able to identify all the nasty files trying to exploit vulnerable applications. D-Analyzer supports all kind of documentation, regardless the file types. Obviously, our tool can also detect 0-day attack, with zero false positive. The presentation includes some demos, so the audience can see how D-Analyzer really works.	NGUYEN ANH QUYNH
1030 - 1100	Coffee Break
1100 - 1200	MOONSOLS WINDOWS MEMORY TOOLKIT This talk is introducing MoonSols Windows Memory Toolkit aims at being the ultimate memory and crash dump acquisition and conversion tool for Windows. Including live acquisition on Windows of Microsoft crash dumps, the conversion of hibernation file into crashdump, and even to get a crashdump of a running VMWare Virtual Machine without rebooting it and without any BSOD !	MATTHIEU SUICHE
1200 - 1230	Break
1230 - 1330	UNDER THE KIMONO OF OFFICE SECURITY ENGINEERING This is a multipart presentation presented by engineers working on Microsoft Office security. The first part will detail a distributed fuzzing framework. The second part will detail engineering defenses to fuzzing attacks in the upcoming release of Office (Office 2010). Security researchers and zero day exploits continue to leverage fuzzing bugs in Microsoft products. What are we doing to defend our products? As presented during Blue Hat 2009 (Jason Shirk) and Cansecwest 2008 (Charlie Miller), the more fuzzing iterations performed, the more likely you are to find bugs. The SDL now requires a clean fuzz run of half a million iterations in order to ship. Seems like a good idea and achievable, but what happens if your application parses more than 200 formats? Time to think like a black hat and leverage the power of a botnet to get your work done - complete with fuzzing commands and control servers to delegate work to the fuzzing bots. This presentation covers a framework built by the Office team to efficiently fuzz any file format parser. This framework can be used by any internal product team that parses file input and significantly reduces the pain around file fuzzing. This framework is not a fuzzer itself. You won't need to rewrite your fuzzers. Instead it allows existing fuzzers to plugin and run in a distributed fashion. The Office team is using this system to perform millions of iterations per day without purchasing any additional hardware. The Office team turned desktop machines and lab machines into a botnet for fuzzing during downtime. Other challenges that are solved by the distributed fuzzing framework and covered in this presentation include central run management, recurring job scheduling, duplicate detection across machines and runs, automated regression passes, and automated bug filing. Even with millions of fuzz iterations and following the best practices of the Security Development Lifecycle (SDL), some bugs will be missed. The Office security team has engineered a series of layered defenses in addition to strengthen the parsers themselves. This presentation also covers two of these layers. The first layer, Gatekeeper, helps validate if the data should be loaded by the target application. The Gatekeeper architecture allows it to be used by other applications and describe additional binary formats. The second layer discussed leverages Windows Integrity Levels and is known as Protected View. Even if malicious code runs inside of Protected View, it should not be able to alter the host machine. The presentation will demonstrate how recent MSRC cases are mitigated by Protected View and Gatekeeper.	TOM GALLAGHER & DAVID CONGER Microsoft
1330 - 1430	Lunch
1430 - 1530	AUTOMATED SQL OWNAGE TECHNIQUES Two of the biggest problems with SQL-injection vulnerabilities are that the tools that detect them have a rate of false positives which is non-negligible or sometimes just too high, and, when a tool detects a vulnerability, it will provide little or no information to developers and testers, hence, it becomes difficult for these to assess the impact of the vulnerability in the security posture of the web application. We introduce a methodology and an implementation of this methodology into a black-box tool that solves the two problems. Using it, one can verify with 100% certainty that a potential SQL injection vulnerability is exploitable, and at the same time assess the impact of the vulnerability. Explicitly, if our tool detects a vulnerability, it provides an interface to execute arbitrary SQL code through them; this would confirm the vulnerability and give the developers an easy way to assess the impact of the vulnerability. Using a combination of heuristics and syntax analysis, our tool constructs a "channel" for each vulnerability that will encode SQL queries to the webapp and their answers solving problems related to encoding of for the tester. The core of this talk is in examining the difficulties that appear while trying to expose vulnerabilities and how to setup a process that will automatically turn them into a black-box query console.	SEBASTIAN CUFRE
1530 - 1600	Coffee Break
1600 - 1700	INDUSTRIAL BUG MINING - EXTRACTING, GRADING AND ENRICHING THE ORE OF EXPLOITS If bugs are the raw ore of exploits - Rootite, if you like - then we're mining in areas where the Rootite is rare and deeply buried. Industrial scale bug mining starts with very, very fast fuzzing. In contrast to the MS Fuzzing Botnet, we use a dedicated, single purpose cluster of virtual machines which is optimised for fuzzing. Last year we released some metrics, then MS released better ones. So, we rebuilt the whole system and made it faster and more scalable - can we outperform the Redmond Botnet in one small rack? After a fuzz run, we are left with massive piles of low-grade Rootite, full of impurities such as Nullpointium, which needs to be graded and enriched before it is valuable. After grading, We "enrich" our highest grade Rootite by using differential runtracing of crashes to assist root cause analysis. The runtraces are tens of millions of lines long, but we postprocess them using magic, funky graphs and compression before comparing them side by side with the clean run. Our diff files are plaintext, small enough for us to eyeball them, and allow us navigate to any point in the trace using any debugger we choose. Feel free to drop by for a guided tour of the mine. Bring a beer.	BEN NAGY COSEINC
	End of Day 1

DAY 2 (24th September 2010)

TIME	TOPIC	SPEAKER
1000 - 1100	PAYLOAD ALREADY INSIDE: DATA RE-USE FOR ROP EXPLOITS Return-oriented programming (ROP) is one of the buzzing advanced exploitation techniques these days to bypass NX. There are several practical works using ROP techniques for exploitations on Windows, iPhoneOS to bypass DEP and code signing but no any practical ROP work for modern Linux distributions so far. Main issues for ROP exploitations on Linux x86 include ASCII-Armor address protection which maps libc address starting with NULL byte and Address Space Layout Randomization (ASLR). In this presentation we will show how we can extend an old return-into-libc technique to a stage-0 loader that can bypass ASCII-Armor protection and make ROP on Linux x86 become a reality. In addition, by reusing not only codes but also data from the binary itself, we can build any chained ret2libc calls or ROP calls to bypass ASLR protection.	LONG DE DINH
1100 - 1130	Coffee Break
1130 - 1230	KICKING THE VULNERABILITIES OUT OF MICROSOFT PATCHES The presentation would be highly technical and would talk about Microsoft Patches Analysis and diffing. The presentation would show how to take Microsoft security patches (Patch Tuesday), analyze them and create exploits from their info (Exploit Wednesday) in the same way hackers and security researchers do. We will talk about the tools, steps and methods of doing the Microsoft patch analysis and diffing. This presentation contains advanced security research material and directed to security researchers.	YANIV MIRON
1230 - 1330	Lunch
1330 - 1430	THE WEB BROWSER TESTING SYSTEM Anyone who has tested browsers for security issues quickly learns that you need more than just a web server. The aim of WBTS is to arm security testers with a system that lets them focus on finding bugs, not fiddling with DNS configurations, building a logging system or building a test case system that works across multiple browser types. The purpose of this presentation is to introduce the tools, the test case system and the general methods for testing the various functionality of a web browser or user-agent. So, what is WBTS? A cross-platform web application server supporting SSL, Virtual Hosts, processors for various web languages and the ability to include your own. All built on python's stupid fast Twisted framework. A built in DNS server to allow records to be created on the fly, as well as built-in DNS rebinding functionality accessible via web requests. A cross-browser JavaScript test case framework that allows you to quickly create new test cases for various browser bugs using different automation methods. The framework hooks into MongoDB to store the results in an easily search-able data store. Lots of test cases both from public sources such as WebKit's LayoutTests, old known browser vulnerabilities taken from Mozilla Firefox's and Google Chrome's bug tracker systems as well as ones created by myself. A slick management Web UI to review test results and configure WBTS. Future plans to implement a fully featured fuzzing framework.	ISAAC DAWSON
1430 - 1500	Break
1500 - 1600	COSEINC AUTOMATED MALWARE ANALYSIS LAB (CAMAL) Thousands of malware are being detected each day and the sheer volume made it impossible to perform manual analysis on each of them. This talk will introduce CAMAL (COSEINC Automated Malware Analysis Lab) an automated malware analysis framework that can produce both static and network analysis snapshots of a malware. The main objective of such a framework is to speed up a malware analyst's job by automatically profiling the malware's binary characteristics, its interaction with the operating system, its access to the file system and its communication through the network. During the talk, we will be first discuss the general framework, followed by technical details on how the whole process can be automated seamlessly. We will also touch on the potential usage of such a framework and how it can help to provide an accurate malware characterization within a shorter timeframe.	UDI SHAMIR COSEINC
1600 - 1630	Coffee Break (Beer Available)
1630 - 1730	BASE JUMPING: ATTACKING GSM BASE STATION SYSTEMS AND MOBILE PHONE BASE BANDS Technological advances have finally placed GSM tools within the reach of security researchers and hackers. Finally it is possible to directly explore the lowest levels of the GSM stack. This talk focuses on both sides of the GSM network where the users and network directly interact: the Um (air) interface. The primary technological focus of this talk is on the exposed interfaces between the GSM networks and users. This covers the base station system -- the network components which communicate with mobile phones -- and the base band -- the component of the mobile phone which communicates with the network. During the talk the two main components of the attack system will be demoed - malicious basestations and malicious basebands. The base station enables fuzzing mobile phone basebands, as well as other attacks. The baseband is used to test GSM network equipment for flaws, as well as exploit backend systems. Trust us, you'll *want* to turn off your phone for the duration of this talk!	THE GRUGQ COSEINC
1730 - 1800	LUCKY DRAW
	End of SyScan'10 Ho Chi Minh City