DAY 1 ( 28th April 2011 )

TIME	TOPIC	SPEAKER
0900 - 0915	Opening and Welcome Address	Thomas Lim Organiser, SyScan'11, CEO, COSEINC
0915 - 1015	Targeting the iOS Kernel Although the iPhone user land is locked down very tightly, previous talks about iPhone security have concentrated on user land attacks only. Therefore demonstrated exploit payloads have been very limited in what they can do or cannot do. More complicated work like user land rootkits or the addition of ASLR protection therefore relied entirely on kernel exploitation help from the jailbreaking community. This presentation will introduce the audience into finding security bugs in iOS kernelspace and how this is different from hunting kernel bugs in Mac OS X. Reverse engineering will be used to extract a lot of information from the kernelcache and then this information is used to enumerate the kernel's attack surface and the corresponding code is located. In addition to that the secrets of activating the iOS internal kernel debugger will be revealed and it will be demonstrated by debugging a previous disclosed iOS kernel exploit.	Stefan Esser SektionEins
1015 - 1030	Coffee Break (Beer Available)
1030 - 1130	Fine-Grained Tracing Without Binary Instrumentation In reading through the Intel x86 instruction set reference, I stumbled across the Branch Trace Store facility. It enables the logging of Branch Trace Messages. This mechanism records the linear address of the last branch 'from' and the linear address of the last branch 'to', as well as if the branch was predicted. My work extends Pedram Amini's PaiMei Process Stalker work, where he utilized the Intel BTF (Single Step On branches) facility to calculate basic blocks. This facility can be utilized from userland, and is inherently slow. My work is also similar to Danny Quist's work in Saron, in that it attempts to avoid detection by moving analysis into ring 0, but where he uses page faults I utilize the intel trace hardware. Admittedly, my work is not as hardcore as the virtual machine introspection projects: Azure/Ether and Qebek (props). By patching the windows scheduler and setting the Intel trace hardware to utilize BTS (and specifying it only trace CPL > 0) I hope to show runtime tracing performance is better than that of other methods (dynamic binary instrumentation: pin/saron, virtual machine introspection: Qebek, tracing hardware: PaiMei Process stalker), and since it doesn't instrument the binary or use common debug API's/ handlers, classic anti-re detection techniques will be subverted. I hope to demo the tool tracing Skype (anti-anti-re), tracing themida and vm-protect hardened binaries (possible virtual opcode handler detection). The presentation will start off with a survey and explanation of current tracing options and ways to detect them, then detail my implementation and how to detect it. I plan to incite discussion with the audience regarding pros and cons of each discussed technique, as well as explain how binary instrumentation can produce unexpected/unwanted results.	Ryan MacArthur iSIGHT Partners
1130 - 1145	Break (Beer Available)
1145 - 1245	Malware Classification Using Call Graphs Due to the grown in the number of malwares, and the different techniques used to spread, communicate and control the infected systems, automation of malware analysis become very important for the malware researcher. Along with the automation process there is a need to identify similarities of existing malware families and to detect new variant which automation process cannot solve without classification tool. Classification process can help researchers to identify outbreaks, assist antivirus companies to improve their heuristics algorithms and detect new variant and new techniques employed by malware authors.	Udi Shamir COSEINC
1245 - 1400	Lunch
1400 - 1500	Mobile Money is not a Ringtone To be updated	The Grugq COSEINC
1500 - 1515	Break (Beer Available)
1515 - 1615	I'm going hunting, I'm the Hunter Recently, a spotlight has been focused on location information and how accessible it is via attacks against smart phones and the global GSM network. But, what about devices whose intent is solely to track an individual or a physical asset? How can these devices be attacked and impersonated? The presenter will reveal how common consumer focused assisted GPS (A-GPS) devices can be manipulated into sending a malicious individual location data and subscriber related information that should only be accessible to the device's owner and the manufacturer. The techniques used to obtain this information bypass the manufacturer's security controls, allowing the attacker to obtain this information in a stealthy fashion. The subscriber does not know that this information is being obtained, and there is no record or log of the request. Next, techniques will be uncovered that demonstrate how to forge location requests. In other words, the presenter will demonstrate how to spoof a moving object. Since these devices are often used to protect vehicles and uncover theft of goods on a particular vehicle, an attacker could impersonate the real route of a commercial vehicle while in reality driving in the opposite direction. Finally, the presenter will demonstrate methods used to hunt down these devices on the telephone network, making almost any A-GPS device susceptible to potential data interception. The presenter will wrap the talk up by detailing how these devices can be uncovered in an immediate vicinity using a USRP and the GSM network. Along the way, tools will be unveiled that implement the aforementioned attacks and a demo will be provided to show how each attack works.	Don Bailey iSEC Partners
1615 - 1630	Coffee Break (Beer Available)
1630 - 1730	The Exploit Shop: Bugs as Business Sadly, ninjas can't be cloned, and they don't work for free. In this talk we will explore areas of the exploit sales business that can be scaled, automated, streamlined and industrialised, and eventually walk through an exploit shop that is light on startup ninjas and cash and yet offers scalable return on invested capital. Don't expect business waffle though, we focus on the technical details of the tools we had to write (and release them), architectures we have developed (and the ones that didn't work), the hardware and software we've found most effective and finish up with the unsolved problems and how we're attacking them.	Ben Nagy COSEINC
1900 - 2200	SyScan'11 Networking Party
End of Day 1

DAY 2 ( 29th April 2011 ))

TIME	TOPIC	SPEAKER
0900 - 1000	Inglourious Hackerds: Targetting Web Clients This talk will show offensive concepts and technical security issues targeting famous Internet Web Clients and platforms. By going back to the protocols (HTTP, etc), and by doing some kind of fuzzing operations, we will show how TEHTRI-Security was able to find interesting security issues. Some of them could apply to most handled devices and to some web browsers for workstations. The attendees will get new HTTP tricks, like how evil attackers could try to become anonymous by creating cove r channels based on web clients, or like how to pwn or crash some web clients, etc. Then we will try to share our thoughts about how to deal with those threats and this world full of inglorious hackerds, targeting web clients... Technical demonstrations and explanations will only be share with SyScan attendees. Join us in Singapore	Laurent Oudot TEHTRI-Security
1000 - 1015	Coffee Break (Beer Available)
1015 - 1115	The road of a bug hunter The presentation will try to answer the epic questions of a beginner in bug hunting. It will help beginners to understand what do they need to look for before finding vulnerabilities in the Windows OS, where do they need to look at, how much time do they need to spend and which skills and knowledge do they need to know. We will answer this from a hacker and a bug hunted perspective.	Moti Joseph COSEINC
1115 - 1130	Break (Beer Available)
1130 - 1230	Looking Into the Eye of the Bits - Memory Analysis During the past three years I've been developing tools for research and implementation of a new type of software analysis, which I will share with the audience. This new type of reverse engineering allows recovering internal implementation details using only passive memory analysis, and without requiring any disassembly. I will also discuss how to cope with the challenge that applications (including DBs) are always in a state of flux - new versions, security updates, etc. keep changing the memory structure. I will answer the question how it is possible to support a new version of the target application without seeing it. I will discuss the added value of the method of internals' recovery over the more common disassembling and decompiling. I will also share my stock of common memory patterns, written in Python, and explain the vast information that can be unearthed simply by roaming in memory land. I will provide a demonstration that will include a description of a new security problem that I found in Microsoft SQL Server (published during 2009), as a result of applying this methodology. I will demonstrate how it is possible to recover the internal structures of a program as complex as a DBMS, and how one can find the important core internals that should be protected. One major application of this technique is discussed, which is to gain the deep knowledge and understanding of the inside building blocks and design of the target application, required to implement monitoring. The method of memory monitoring has never before been used as far as I know for security purposes. It is a method that allows us to achieve a good view of the application activity, on the one hand, while on the other hand minimizing the performance impact (in contrast to methods that require extensive application logging, for example). It depends on the existence of caching, pipelining and buffering of data to create a real time view of the application's activity. When applied efficiently it can be used to protect applications from various exploits and thus can be adopted as an alternative to applying security patches to products, especially when applying the patches comes at a very high cost (e.g. extensive testing of applications, shutting mission critical applications down, etc.).	Assaf Nativ Sentrigo
1230 - 1400	Lunch
1400 - 1500	Telecom Signaling attacks on 3G and LTE networks from SS7 to all-IP, all open Telecom security is way more than SIP-breaking some peripheral PBXs and raking a few thousands of dollars of free calls. From the formerly closed garden of SS7 to new all-IP telecom protocols such as Diameter and LTE protocols, the telecom domain faces now both the challenges of availability -one minute of downtime costs literally millions- and signaling vulnerabilities cutting down entire countries, causing massive frauds and the all new networking protocols. These new telecom protocols are rolled out in IP-centric fashion, with its myriad of standard IP security pitfalls and vulnerabilities, as well as very specific telecom vulnerabilities. The HLR is not only using TCP/IP for OAM and business workflow, but also now being named an HSS, it uses IP-only protocols such as Diameter for its Core Network signaling operations. That means that now telecom are facing new security risks both in term of exposure and threats, with its Core Network being exposed to unsophisticated IP-centered attackers, and the continuous waves of telecom-centered defrauders. In this presentation, we'll demo the new technologies of 3G and LTE networks and how to attack and defend them. We'll also show what kind of exposure one telecom companies, Mobile Network Operators and SS7 providers shows to external attackers.	Philippe Langlois P1 Security inc.
1500 - 1515	Break (Beer Available)
1515 - 1615	Fuzzing and Debugging Cisco IOS We will present a tool to facilitate the debugging and reverse engineering process of Cisco IOS by allowing the integration with the most used existing debugging and disassembler tools such as GDB and Ida Pro. This solution consists of a modification to provide instrumentation capabilities for an existing hardware emulator called Dynamips. Among other things our modification will allow to use existing fuzzing tools and frameworks, complete analysis of boot-loading process, debug the target IOS independently from pre-existing built-in GDB on IOS image, provide more reliability during debugging session and provide an isolated environment to reproduce attacks and analyze IOS malware.	Alfredo Ortega Groundworks Technologies
1615 - 1630	Coffee Break (Beer Available)
1630 - 1730	Gold or Amalgam, how to find weak fixes Vuln patching is like patching teeth, you can either go for the quick and cheap method or a quality fix that proofs the test of time and research. We will show a series of checks how to check the quality of a fix, and identify whether an issue was a surface fix, and there is still rotten material under it, or the root cause was addressed and the likeliness of similar exploits is significantly reduced. We cover fuzzing and other reproducer mutation techniques that build up the practical part of this research.	Marc Schonefeld Red Hat
1730 - 1800	Lucky Draw
End of SyScan'11 Singapore