Black Hat e Defcon 2009 - principais temas

[ Update - 03/08/2009 ]

O material apresentado na Black Hat já está disponível para download. Segue a lista completa:

1. Alessandro Acquisti- I Just Found 10 Million SSN’s
2. Dmitri Alperovitch, Keith Mularski- Fighting Russian Cybercrime Mobsters: Report from the Trenches
3. Andrea Barisani, Daniele Bianco- Sniff Keystrokes With Lasers/Voltmeters
Side Channel Attacks Using Optical Sampling of Mechanical Energy and Power Line Leakage
4. Marc Bevand- MD5 Chosen-Prefix Collisions on GPUs
5. Bill Blunden- Anti-Forensics: The Rootkit Connection
6. Hristo Bojinov, Dan Boneh, Elie Bursztein- Embedded Management Interfaces: Emerging Massive Insecurity
7. Michael Brooks, David Aslanian- BitTorrent Hacks
8. Jesse Burns- Exploratory Android Surgery
9. K. Chen- Reversing and Exploiting an Apple® Firmware Update
10. Matt Conover- SADE: Injecting Agents into VM Guest OS
11. Dino Dai Zovi- Advanced Mac OS X Rootkits
12. Datagram- Lockpicking Forensics
13. Nitesh Dhanjani- Psychotronica: Exposure, Control, and Deceit
14. Mark Dowd, Ryan Smith, David Dewey- The Language of Trust: Exploiting Trust Relationships in Active Content
15. Muhaimin Dzulfakar- Advanced MySQL Exploitation
16. Michael Eddington- Demystifying Fuzzers
17. Egypt- Using Guided Missiles in Drive-by’s: Automatic browser fingerprinting and exploitation with Metasploit
18. Rachel Engel- Gizmo: A Lightweight Open Source Web Proxy
19. Stefan Esser- State of the Art Post Exploitation in Hardened PHP Environments
20. Tony Flick- Hacking the Smart Grid
21. Andrew Fried, Paul Vixie, Dr. Chris Lee- Internet Special Ops: Stalking Badness Through Data Mining
22. Chris Gates- Breaking the “Unbreakable” Oracle with Metasploit
23. Travis Goodspeed- A 16 bit Rootkit and Second Generation Zigbee Chips
24. Joe Grand, Jacob Appelbaum, Chris Tarnovsky- “Smart” Parking Meter Implementations, Globalism, and You
25. Jennifer Granick- Computer Crime Year In Review: MySpace, MBTA, Boston College and More
26. Jeremiah Grossman, Trey Ford- Mo’ Money Mo’ Problems: Making A LOT More Money on the Web the Black Hat Way
27. Peter Guerra- How Economics and Information Security Affects Cyber Crime and What It Means in the Context of a Global Recession
28. Nathan Hamiel, Shawn Moyer- Weaponizing the Web: More Attacks on User-Generated Content
29. Nick Harbour- Win at Reversing: Tracing and Sandboxing through Inline Hooking
30. Riley Hassell- Exploiting Rich Content
31. Mikko Hypponen- The Conficker Mystery
32. Vincenzo Iozzo, Charlie Miller- Post Exploitation Bliss: Loading Meterpreter on a Factory iPhone
33. Dan Kaminsky- Something about Network Security
34. Peter Kleissner- Stoned Bootkit
35.Kostya Kortchinsky- Cloudburst: Hacking 3D (and Breaking Out of VMware)
36. Zane Lackey, Luis Miras- Attacking SMS
37. Aaron LeMasters, Michael Murphy- Rapid Enterprise Triaging (RETRI): How to Run a Compromised Network and Keep Your Data Safe
38. Felix “FX” Lindner- Router Exploitation
39.Kevin Mahaffey, Anthony Lineberry, John Hering- Is Your Phone Pwned? Auditing, Attacking and Defending Mobile Devices
40. Moxie Marlinspike- More Tricks For Defeating SSL
41. John McDonald, Chris Valasek- Practical Windows XP/2003 Heap Exploitation
42. Haroon Meer, Nick Arvanitis, Marco Slaviero- Clobbering the Cloud!
43. Erez Metula- Managed Code Rootkits: Hooking into the Runtime Environments
44. Charlie Miller, Collin Mulliner- Fuzzing the Phone in your Phone
45. David Mortman- A Black Hat Vulnerability Risk Assessment
46. Graeme Neilson- Netscreen of the Dead: Developing a Trojaned ScreenOS for Juniper Netscreen Appliances
47.Steve Ocepek- Long-Term Sessions: This Is Why We Can’t Have Nice Things
48. Jeongwook Oh- Fight Against 1-day Exploits: Diffing Binaries vs Anti-diffing Binaries
49. Alfredo Ortega, Anibal Sacco- Deactivate the Rootkit
50. Danny Quist, Lorie Liebrock- Reverse Engineering By Crayon: Game Changing Hypervisor Based Malware Analysis and Visualization
51. Tiffany Strauchs Rad, James Arlen- Your Mind: Legal Status, Rights and Securing Yourself
52. Daniel Raygoza- Automated Malware Similarity Analysis
53. Peter Silberman, Steve Davis- Metasploit Autopsy: Reconstructing the Crime Scene
54. Val Smith, Colin Ames, David Kerb- MetaPhish
55. Mike Zusman, Alexander Sotirov- Breaking the security myths of Extended Validation SSL Certificates
56. Kevin Stadmeyer, Garrett Held- Worst of the Best of the Best
57. Bryan Sullivan- Defensive Rewriting: A New Take on XSS/XSRF/Redirect-Phishing Defense
58. Chris Tarnovsky- What the hell is inside there?
59. Steve Topletz, Jonathan Logan and Kyle Williams- Global Spying: Realistic Probabilities in Modern Signals Intelligence
60. Michael Tracy, Chris Rohlf, Eric Monti- Ruby for Pentesters
61. Dustin “I)ruid” Trammell- Metasploit Telephony
62. Eduardo Vela Nava, David Lindsay- Our Favorite XSS Filters and How to Attack Them
63. Mario Vuksan, Tomislav Pericin- Fast & Furious Reverse Engineering with TitanEngine
64. Chris Weber- Unraveling Unicode: A Bag of Tricks for Bug Hunting
65. Jeff Williams- Enterprise Java Rootkits

[ Post Original - 27/07/2009 ]

A Black Hat e a Defcon estão entre as mais importantes conferências de segurança computacional do ano. Os eventos acontecerão nesta semana em Las Vegas e a comunidade já está se preparando para um festival de correções de segurança de última hora e uma avalanche de novas informações em todas as áreas de segurança computacional.

Segue um breve apanhado de informações sobre os destaques das duas conferências:

• Mapa Geral: Calendário de eventos da Black Hat, por tópicos.
• Mapa Geral: Talk Choices do pessoal da Tipping Point.
• Forense de Memória: Plugin do Memoryze para detecção do Meterpreter (Metasploit)
• Anti-Forense: Rootkits com funcionalidades de Anti-Forense avançadas.
  
• Patches fora de hora: Microsoft já sinalizou mais correções para o IE e Visual Studio
  
• Criptografia: HP desenvolve darknet para navegadores
  
• Criptografia: Bypass de certificados EV-SSL em todos os navegadores
• Virtualização: CloudBurst - Explorando um Host VMWare a partir do Guest
  
• Segurança de BD: Novo módulo do MSF para exploração de BDs Oracle