第一天　(7月8号 2010年)

时间	议程	讲师
0900 - 0930	至开幕与欢迎词 OPENING AND WELCOME ADDRESS	THOMAS LIM SyScan'10, COSEINC
0930 - 1030	工业化漏洞挖掘—提取、分级与富化exploit的矿石 如果说漏洞是exploit的原始矿石，那么那些真正有价值的exploit是非常稀有并且往往被埋在矿石的深处。 工业级的漏洞挖掘首先需要一个非常快速的fuzzing方法。与微软的fuzzing机器人网络相比，我们使用了一 种专用的、单一目的的虚拟机群，并且针对fuzzing工作做了优化。去年我们公布了一些数据，不过微软很快 公布了更好的。因此我们重新设计了整个系统使它更快速并且更灵活，我们可能在某些方面比Redmond Botnet 更出色吗？运行一次fuzz后，我们获得了大量低级的Rootite，例如空指针引用，这些bug需要分级并处理才能有 价值。在分级后，我们会使用不同的运行跟踪记录分析来使那些最高级别的Rootite更有价值。运行跟踪记录往往 有上百万行，我们在与正常的运行流程比较前使用了各种方法进行处理。我们的diff文件是明文的，并且小到足以 用肉眼进行判断，并且允许我们使用调试器运行到指定的节点。带上一瓶啤酒，经历一次带导游的挖宝之旅吧。 INDUSTRIAL BUG MINING - EXTRACTING, GRADING AND ENRICHING THE ORE OF EXPLOITS If bugs are the raw ore of exploits - Rootite, if you like - then we're mining in areas where the Rootite is rare and deeply buried. Industrial scale bug mining starts with very, very fast fuzzing. In contrast to the MS Fuzzing Botnet, we use a dedicated, single purpose cluster of virtual machines which is optimised for fuzzing. Last year we released some metrics, then MS released better ones. So, we rebuilt the whole system and made it faster and more scalable - can we outperform the Redmond Botnet in one small rack? After a fuzz run, we are left with massive piles of low-grade Rootite, full of impurities such as Nullpointium, which needs to be graded and enriched before it is valuable. After grading, We "enrich" our highest grade Rootite by using differential runtracing of crashes to assist root cause analysis. The runtraces are tens of millions of lines long, but we postprocess them using magic, funky graphs and compression before comparing them side by side with the clean run. Our diff files are plaintext, small enough for us to eyeball them, and allow us navigate to any point in the trace using any debugger we choose. Feel free to drop by for a guided tour of the mine. Bring a beer.	BEN NAGY COSEINC
1030 - 1100	茶点 / Coffee Break
1100 - 1200	基于NDIS中间层驱动的恶意流量的监听与分析 网络驱动接口规格（NDIS）是一个网络驱动架构的详细说明，它允许传输协议能以不依赖硬件的方式与网卡或其它硬件设备通信。 NDIS库实现了开放系统模型中存在于网络的层2（链路层）与层3（网络层）之间的边界。NDIS驱动客户端用该库来格式化命令并与 NDIS驱动通信。NDIS驱动接口库用于扮演在请求与响应活动间接收发送信息的角色。有一些不同类型的NDIS驱动允许传输协议 与硬件层之间通信，并在不同的配置中实现。监听机制是通过NDIS中间层驱动的技术来实现的，这是微软推荐的嵌入系统方法，因 为它能很好得兼容不同的操作系统版本和其它应用驱动。这篇论文清楚地描述了通过NDIS中间层驱动的恶意网络流量的监听与分析 方法。NDIS中间层驱动被用于在网络流量到达OSI模型高层前进行预处理。如果流量包含恶意行为，对网络流量监听的分析将会被 自动实施。本次会描述用于实现中间层驱动的代码。 INTERCEPTION AND ANALYSIS OF MALICIOUS TRAFFIC BASED ON NDIS INTERMEDIATE DRIVER Network Driver Interface Specification (NDIS) is a specification for network driver architecture that allows transport protocols to communicate with network interface cards (NICs) or other hardware device in a device-independent manner. he NDIS library implements the NDIS boundary that exists between network layer 2 (Data Link Layer) and layer 3 (Network Layer) of the Open Systems Interconnection (OSI) model. This library is a helper library which NDIS driver clients use to format commands that communicate with NDIS driver. The NDIS driver interface’s library will act as receiving and sending between the request and response activities. There are different types of NDIS driver which allow the transport protocols to communicate with the hardware layer and implement in different configuration. Interception mechanism is implemented by the technology of NDIS Intermediate Driver where this embedded system method is recommended by the Microsoft Company as it provides maximum compatibility both with different OS’s versions and other applications and drivers. This paper clearly describes the interception and analysis of malicious network traffic through the NDIS intermediate driver. The concept of NIDS intermediate driver has been used to intercept network traffic before it reaches to higher OSI model. Auto analysis of the intercept network traffic will be conducted if the traffic consists of malicious functions. Source codes that act as an interception-driver for network packets will be described.	LEE LING CHUAN CyberSecurity Malaysia
1200 - 1300	Lunch
1300 - 1400	数据恢复技术在清除顽固恶意程序和Anti Rootkit中的应用 数据恢复软件之所以能够恢复数据，是因为数据还存在于硬盘之中，数据恢复软件通过分析仍然保留在磁盘中的文件系统数据结构， 将已经删除或者格式化等原因丢失的文件，重新整理出来，并保存成为一个新的文件，这个过程实现数据恢复。 这一技术能否应用于其它方面呢？比如利用这一技术进行Anti Rootkit、清除顽固的恶意程序、提过杀毒引擎扫描速度？ 一 利用数据恢复技术实现文件Anti Rootkit利用解析文件系统数据结构搜索文件的方式与简单调用windows提供的搜索文件API的对比结果，来分析某个文件是否被Rootkit。 二 利用数据恢复技术对顽固恶意程序进行清除通过解析文件系统数据结构，定位某个恶意程序在磁盘中的物理位置，直接对磁盘进行写操作，从而实现对恶意软件的清除。 三 提过杀毒引擎扫描速度的方法 这是一种神奇的方法，任何杀毒厂商只要运用这套技术，立刻可以提过2～3倍的扫描文件速度，本方法通过解析文件系统数据结构， 定位文件数据，直接通过磁盘I/O访问文件头固定大小数据块，进行病毒库匹配。比传统的调用文件访问Api速度快2～3倍。	涂彦晖
1400 - 1415	休息 / Break
1415 - 1515	恶意软件自动化分析实验室 那些恶意软件作者所介绍的最新的恶意软件正越来越复杂化，RootKits对恶意软件研究者和杀毒软件公司提出了新的的挑战。深 层次分析的需求将包括静态的和动态分析，并且需要向IDS/IPS厂商提供网络指纹。此次恶意软件自动化分析实验室能够提供研 究者深层二进制分析（反编译，内存dump），网络流量剖析，甚至于提供snort风格的网络签名。整个过程都是不需要人工干预，并且适 用于运行大规模分析的。 在讲座中我将会谈论我用于构建这个框架的技术并且会提供演示。 MALWARE ANALYSIS AUTOMATION LAB The growing of sophistication and complexity Malware authors introducing with their latest Malwares, RootKits creates new challenges to the Malware researches as well as to the Anti Virus companies. The need for deep analysis which will cover both static, dynamic as well as Network Fingerprinting for the IDS/IPS vendors is a MUST. The Malware Analysis Automation Lab is a Framework which provides the researcher with Deep binary analysis (Disassembler overview, Binary memory dump) , Network traffic dissection and even provides Pseudo network signatures snort style.(when applicable), all the process is being done completely un-attended and suitable for processing large scale analysis. In the lecture I will talk about the technique i used to build the Framework as well provide Live Demo.	UDI SHAMIR COSEINC
1515 - 1645	茶点 / Coffee Break
1645 - 1745	寂静的脚步：提高Web黑客行为的隐蔽性 这次议题从一个攻击者的角度出发，涵盖了web黑客攻击以及隐蔽性相关问题。我们会介绍新的攻击概念，并 将展示攻击者是如何隐蔽自己，从而防守者方会了解到一些当前流行的环境和工具的局限。 首先，我们将看看如何在信息收集和侦查阶段提高攻击的隐秘性。我们将会展示攻击者在攻击目标时为何会 不经意得留下指纹。我们看看一旦攻击者成功进入系统，他们是怎样试图隐藏或清理此类的一些指纹信息。接 着我们看一下攻击者是如何试图持续控制主机，特别是通过web后门的方式，并且解释攻击者是怎样被发觉 的。我们来看看一些有趣的web后门，从中了解它们是怎样做到隐秘性的，他们当前的弱点/局限是什么， 和我们认为它们需要升级改进的方面。 在得出结论之前，我们会介绍一些新的攻击概念，可以绕过大部分网络入侵检测系统攻击web目标。其中一部 分也能被应用在与web无关的目标上，但是这不在本次演讲的讨论范围。 SILENT STEPS: IMPROVING THE STEALTHINESS OF WEB HACKING This talk aims at covering web hacking and stealth issues from an attackers stand point. We will introduce new offensive concepts that demonstrate how attackers (pentesters, blackhats, etc) can become stealthier on the wire, so that defenders understand some kind of limitations of the current situation and tools. At first, we will look at improving the stealthiness of attacks during the information gathering and recon stage. We will then show how and why attackers might inadvertently leave fingerprints while exploiting a target. Once attackers have successfully ‘rooted the box’, we will look at how they try to hide or clean some of these fingerprints. We will then move to the way attackers try to maintain access, especially through web backdoors and also explain how attackers could be detected. We will also look at some interesting web backdoors so that we will see how they have become stealthier, what their current weaknesses/limitations, and how we could think they might be upgraded / improved. Before concluding, we will introduce some new attack concepts that allows for manual and automatic attacks against web targets with a kind of embedded stealth protection that might automatically defeat most Network Intrusion Detection Systems (NIDS) and associated sensors. Some of these attack concepts can also be applied to non-web related targets but will be beyond the scope of this presentation	LAURENT OUDOT TEHTRI-SecurITY
	End of Day 1

第二天　(7月9号 2010年)

时间	议程	讲师
0900 - 1000	KIMONO下的OFFICE安全工程 这是一个由在微软office安全工作的工程师们展示的多环节演示。第一部分会详细说明一个分布式fuzzing框架。第二部分会详细说明在即将发行的office版本（office 2010）中的防御fuzzing攻击的方法。 安全研究者和0day开发人员持续地在微软的产品中找到bug。我们应该做些什么来保护我们的产品呢？正 如在 Blue Hat 2009 (Jason Shirk) 和 Cansecwest 2008 (Charlie Miller)中展示的那样， fuzzing的次数越多，就越有可能找到bugs。SDL现在要求产品必须通过50万次迭代的fuzz测试。这看上去 像是一个能够做到的好办法，但是如果你的应用涵盖了超过200种格式将会发生什么呢？是时候 像一个black hat那样去思考了，借助机器人网络的力量来帮助你完成工作——通过fuzzing命令来控制服务 器为每个fuzz机器人分配工作。 这个演示包括了一个Office小组搭建的框架，能够有效得fuzz任何文件格式。这个框架可以被任何内部产 品小组使用，帮助解析输入的文件并减轻fuzz的负担。这个框架本身不是一个fuzzer，你不用重写你的fuzzer。它允许 现有的fuzzers做为插件在分布式环境中运行。这个Office小组正在使用这套系统每天进行上百万次的迭代 测试，不需要添置任何额外的硬件。该小组将台式机和实验室机器变成一个在空闲时间fuzzing的机器人。本次演讲 会提到分布式fuzzing框架能解决的一些挑战，包括集中运行控制、工作分配、跨机器的运行和检测，自动化的漏洞修补。 即使产品通过几百万次fuzz迭代测试并遵从安全部署生命周期(SDL)的开发规定，仍然会错过一些bug。Office安全小组通过设置一些保护层 来加强文件解析器的保护。这次演讲也涵盖了其中的2层。第一层，Gatekeeper，帮助验证数据是否应该被目标程序加载。Gatekeeper架构允许 被其它应用程序使用和描述额外的二进制格式。第二层被称为Protected View，它是对Windows系统完整性的补充。即使恶意 代码在Protected View中运行，它也无法控制主机。报告将会演示最近的MSRC利用Protected View和Gatekeeper进行保护的案例。 UNDER THE KIMONO OF OFFICE SECURITY ENGINEERING This is a multipart presentation presented by engineers working on Microsoft Office security. The first part will detail a distributed fuzzing framework. The second part will detail engineering defenses to fuzzing attacks in the upcoming release of Office (Office 2010). Security researchers and zero day exploits continue to leverage fuzzing bugs in Microsoft products. What are we doing to defend our products? As presented during Blue Hat 2009 (Jason Shirk) and Cansecwest 2008 (Charlie Miller), the more fuzzing iterations performed, the more likely you are to find bugs. The SDL now requires a clean fuzz run of half a million iterations in order to ship. Seems like a good idea and achievable, but what happens if your application parses more than 200 formats? Time to think like a black hat and leverage the power of a botnet to get your work done – complete with fuzzing commands and control servers to delegate work to the fuzzing bots. This presentation covers a framework built by the Office team to efficiently fuzz any file format parser. This framework can be used by any internal product team that parses file input and significantly reduces the pain around file fuzzing. This framework is not a fuzzer itself. You won’t need to rewrite your fuzzers. Instead it allows existing fuzzers to plugin and run in a distributed fashion. The Office team is using this system to perform millions of iterations per day without purchasing any additional hardware. The Office team turned desktop machines and lab machines into a botnet for fuzzing during downtime. Other challenges that are solved by the distributed fuzzing framework and covered in this presentation include central run management, recurring job scheduling, duplicate detection across machines and runs, automated regression passes, and automated bug filing. Even with millions of fuzz iterations and following the best practices of the Security Development Lifecycle (SDL), some bugs will be missed. The Office security team has engineered a series of layered defenses in addition to strengthen the parsers themselves. This presentation also covers two of these layers. The first layer, Gatekeeper, helps validate if the data should be loaded by the target application. The Gatekeeper architecture allows it to be used by other applications and describe additional binary formats. The second layer discussed leverages Windows Integrity Levels and is known as Protected View. Even if malicious code runs inside of Protected View, it should not be able to alter the host machine. The presentation will demonstrate how recent MSRC cases are mitigated by Protected View and Gatekeeper.	TOM GALLAGHER Microsoft
1000 - 1030	茶点 / Coffee Break
1030 - 1130	返回到PHP解释器--PHP中内存漏洞的远程溢出利用仍未终结 返回到PHP解释器--PHP中内存漏洞的远程溢出利用仍未终结 WEB应用安全专家中最流行的观点认为，像缓冲区溢出和其它内存崩溃那样的底层漏洞对WEB应用 安全没有影响。再加上在现代WEB服务器上使用溢出保护技术的增加，许多人认为利用WEB服务器软 件中的内存漏洞进行远程溢出已经不可行了。但的确是这样么？ 这次演讲将介绍通过返回到PHP的解释器来利用内存漏洞的办法，并讨论实现的几种方法的必要 条件和可行性。我们将看到这个办法如何被应用于一个未公开的PHP漏洞，该漏洞允许攻击者可 以远程攻击一些常用的PHP应用。我们将会分析该漏洞的各个方面，解释该漏洞产生的原因以及如 何导致内存崩溃。我们会对这样一个远程代码执行的溢出一步步地详细说明。 RETURNING INTO THE PHP INTERPRETER – REMOTE EXPLOITATION OF MEMORY CORRUPTIONS IN PHP IS NOT OVER, YET. Among web application security experts there is the popular believe that low level vulnerabilities like buffer overflows and other kinds of memory corruption vulnerabilities do not matter for web application security. In addition to that the increasing use of exploit mitigation techniques on modern web servers make many believe that exploiting remote memory corruptions in webserver software is over. But is it really? This talk will introduce the idea of returning into the PHP interpreter from memory corruption vulnerabilities and discuss the requirements and feasibility of different ways to do that. This idea will then be applied to a yet undisclosed PHP vulnerability, which is exposed to remote attackers in several widespread PHP applications. Different aspects of this vulnerability will be analyzed and it will be explained how they can be abused in remote information leak and memory corruption exploits. The creation of such a remote code execution exploit will then be detailed step by step.	STEFAN ESSER Sektioneins
1130 - 1145	休息 / Break
1145 - 1245	反击web攻击者 当在web服务器上检测到攻击时，一些防御者的解决办法是清除入侵者留下的后门并加固系统的结构，防止它们被 再次入侵。有时他们有足够的时间分析发生了什么，并做一些取证工作，或者联系远程管理员和专家等来分析问题。但目前 来看，攻击者可能并不怎么害怕他们电子犯罪带来的后果。 这次演讲的目的是更深入得思考如何重新平衡光明方与黑暗方之间的互联网战争。我们将会在发现邪恶的黑客 后，做一些和以前截然不同的事情。TEHTRI-Security将会说明怎样反击攻击你web的家伙，你可能会：获取更多 关于他们他们的信息或者确认他们的身份，学习他们的工具和方法，或者某些情况下反渗透进他们的电脑。的确，这些 技术提议可能会导致法律上问题，这取决于国际通用的和当地的法律（如正当防卫等）。但是这次发言将会着重于 战术层面的话题，用真实生活中的例子来展示黑掉这些web黑客的可能性。 STRIKING BACK WEB ATTACKERS When an attack is detected on a web server, some defenders try to handle that incident, by getting rid of the intruders and by hardening their infrastructure so that they won't be owned again. Sometimes they get enough spare time to analyze what happened exactly, by doing some kind of forensics actions, or by contacting remote administrators and authorities, etc. But recently, attackers might not really be afraid of the consequences of their digital crimes. This talk proposes to think further and to re-balance the Internet war between the light side and the dark side. We will add a new way to behave when evil hackers are caught on a host. Indeed, TEHTRI-Security will explain how to strike back against your web assailants, so that you would be able to: get more information about them or identify them, steal their tools and methods, or sometimes to penetrate back their own computers too. Of course those technical initiatives might lead to legal issues, depending of the international and local laws (self defense, etc). But this talk will focus on tactical issues, to show real life examples when it might be possible to hack the web hackers.	LAURENT OUDOT TEHTRI-SecurITY
1245 - 1400	Lunch
1400 - 1500	BASE JUMPING：攻击GSM基站系统和手机基带 随着技术的发展，GSM工具最终被摆到了安全研究人员和黑客的面前。终于，我们有可能直接探索最底层的GSM栈。 这次发言同时着重于GSM网络中用户和网络直接进行交互的地方：无线接口的两侧。 发言的技术重点在于GSM网络和用户间暴露出来的接口上。这覆盖了基站系统——与手机通信的网络组件和基带——与网络通信的手机组件。 在发言中，我们将会演示攻击系统的两个主要组件——恶意基站和恶意基带。这里的基站能够像其它攻击方法一样fuzzing手机基带。这里的基带用于试探GSM网络设备的缺陷并溢出后台系统。 相信我们，就在我说话的时候，你一定想关掉你的电话！ BASE JUMPING: ATTACKING GSM BASE STATION SYSTEMS AND MOBILE PHONE BASE BANDS Technological advances have finally placed GSM tools within the reach of security researchers and hackers. Finally it is possible to directly explore the lowest levels of the GSM stack. This talk focuses on both sides of the GSM network where the users and network directly interact: the Um (air) interface. The primary technological focus of this talk is on the exposed interfaces between the GSM networks and users. This covers the base station system -- the network components which communicate with mobile phones -- and the base band -- the component of the mobile phone which communicates with the network. During the talk the two main components of the attack system will be demoed - malicious basestations and malicious basebands. The base station enables fuzzing mobile phone basebands, as well as other attacks. The baseband is used to test GSM network equipment for flaws, as well as exploit backend systems. Trust us, you'll *want* to turn off your phone for the duration of this talk!	THE GRUGQ COSEINC
1500 - 1515	休息 / Break
1515 - 1615	芝麻开门——电子旅行文档、身份证和其它智能卡的安全 此次发言将会给出一个关于2010 ICAO 电子旅行文档标准 MRTDs (Doc 9303)的概述，我们会看到一个完整的端到 端的过程，从获取护照到自动检查系统。它将会展示电子护照的审计技术，说明为何2010版的电子护照几乎不比我们 当年复制的2006版来的好。而随着自动化出入境信息技术投入使用，麻烦比以前大得多。 我们将会看到发行机构和用户遇到的问题，他们该怎样保护他们的电子护照。 听众将会了解到电子护照的概述和以护照持有者的身份来旅行所面临的风险。此外，不仅仅是护照，利用方法和恶意软件 分析可以应用于所有"RFID"智能卡上。 OPEN SESAME - SECURITY OF ELECTRONIC TRAVEL DOCUMENTS, NATIONAL ID CARDS AND OTHER SUPER INTELLIGENT SMART CARDS This talk will give a overview the the 2010 ICAO Version of Electronic Travel Documents MRTDs (Doc 9303), as well will have a holistic end - to - end view from getting a passport up to automated inspection systems. It will show audit techniques of ePassports, and why the 2010 Version of the ePassports are little better then the 2006 Version we cloned that year. But things getting much worse with automated immigration technology in use. We will have a look to the problems of the issuer and the user, and how they should protect their ePassport. The Audience will get an overview of ePassports and the Risks using them as traveler get used by someone else on the name of the passport holder. Additionally the Exploitation and Malware-Analysis apply to every "RFID" Smartcard System, not only to Passports.	LUKAS GRUNWALD DN-Systems Enterprise Internet Solutions GmbH
1615 - 1630	休息 / Break
1630 - 1730	深入了解Mac系统安全性 — 是否如人们想象得那样安全？ 大多数用户认为Mac系统比Windows系统更为安全，并且苹果公司也是如此宣称的。 但是，事实是否真的如此呢？ 本次议题将涵盖Mac系统下的各种安全问题。我们会讨论Mac系统所使用的各种安全 机制以及一些常见的攻击手段。通过与大家熟知的Windows系统下的攻击相比较， 大家能够更清晰得了解Mac系统的安全性。 我们会首先介绍Mac系统的基本情况，并描述有哪些安全措施来保护系统。随后讨 论一些恶意软件技术，包括病毒、木马、键盘记录等等。我们还会详细讨论 Mac系 统下的溢出利用，并展示一个真实的溢出攻击。最后一部分将会介绍Mac系统下的 Rootkit。经过上述的讨论，希望大家能对Mac系统是否安全有一个新的认识。 LOOK INSIDE MAC OS X – IS IT AS SECURE AS WE EXPECTED? Mac OS is thought to be better than Windows on security aspects. Also Apple Inc announce that Mac OS is strong enough to against virus and attack. But, is that the truth? This talk will cover most kinds of security problems under Mac OS. We will talk about Mac OS security protection mechanism and normal attack vectors. Compared with what happens under Windows, you can figure out that how secure Mac OS is. Firstly, we will introduce what Mac OS is and the security methods used to protect it. Then malware techniques will be discussed, such as virus, trojan horse, keylogger and so on. After that, we will talk about how to exploit vulnerabilties under Mac OS and show you a real exploit. Last part is something about Rootkit under Mac OS. I hope you could have a more clear view of Mac OS security after the talk.	XU HAO Cactus Security Lab
	End of SyScan'10 HangZhou