I’ve spent a lot of hours at home recently building up some continuing education credit hours with security convention videos. I learned a lot, but one key lesson is that there is an ocean of good and a small sea of great security-centric presentations available at no cost for anyone interested in the topic. There is tremendous diversity as well. Here are a few samples, and a set of links to larger collections of security convention presentations. We all have to find ways to stay relevant and to help the staff around us keep up as well. Nothing replaces the kind of energy and valuable interaction that can result from participating in one or another of the many …cons available today. In the context of ever-present spending constraints, though, consider integrating some of these excellent resources into your organization’s development planning:
There are some white hats attempting to build a globally-available list of ‘low hanging fruit’ vulnerabilities for literally all web sites on earth.
In “PunkSPIDER Open Source Fuzzing Project” the presenter explains how they do their work — a mix of web attacks and big data.
VIDEO: http://goo.gl/i0g6pO
or a different version on this topic at: http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t133.mov
JavaScript seems to be everywhere… Because at least some of it is executing on untrusted endpoints, it is crucial to resist abuse and protect ‘upstream’ infrastructure and data.
In “Javascript Static Security Analysis Made Easy with JSPrime” the presenter attempts to explain the scope of this challenge, and then demonstrates his open source static code security analyzer.
VIDEO: http://myrcurial.com/conferences/blackhat-2013-video/2013_bhb_t104.mov
SLIDES: http://goo.gl/jWUnWF
Encryption is something we are supposed to use, but not to write. Using commercial or well-tested open source crypto support libraries should satisfy, right?
Not so fast. In this presentation, “Crypto: You’re doing it wrong” the presenter demonstrates a range of techniques for decrypting both weakly and strongly encrypted cyphertext. I had never read about the approaches used by this individual, and they seem to be applicable across huge sections of our standard industry practices. This is an extremely interesting explanation of how key facets of cryptography work and how implementation details leave much encrypted content vulnerable to hostile decryption. Finally, the presenter outlines what we might do to resist his attacks.
Because it challenges so many deeply held assumptions, I strongly recommend this to anyone involved in software architecture or design.
VIDEO: http://myrcurial.com/conferences/blackhat-2013-video/2013_bhb_t104.mov
Why do people click, or worse, type and then click?
In “Predicting Susceptibility to Socialbots on Twitter” the presenters explore how one might attempt to target people may be more likely to interact with profiles they don’t know on Twitter.
Their approach uses relatively standard statistical analysis against large collections of Twitter log data and establishes a foundation for future work on this topic. The presenters also offer advice about how we might best invest our training budgets to address some of what they found.
VIDEO: http://myrcurial.com/conferences/blackhat-2013-video/2013_bhb_t206.mov
SLIDES: http://goo.gl/R52JRY
And later – corrected version – at: http://goo.gl/YXZaDq
If you are interested in the lowest-level details of great concern to hostile software security specialists, you might want to watch “OptiROP: The Art of Hunting ROP Gadgets.” It will walk you through one of the more productive paths used by malware artists — CPU machine code.
VIDEO: http://myrcurial.com/conferences/blackhat-2013-video/2013_bhb_t112.mov
SLIDES: https://media.blackhat.com/us-13/US-13-Quynh-OptiROP-Hunting-for-ROP-Gadgets-in-Style-Slides.pdf
PAPER: https://media.blackhat.com/us-13/US-13-Quynh-OptiROP-Hunting-for-ROP-Gadgets-in-Style-WP.pdf
There are scores more…
“VoIP Wars: Return of the SIP” http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t118.mov
“Abusing NoSQL Databases” http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t222.mov
“TMI: How to attack SharePoint servers and tools to make it easier” http://goo.gl/9cA9qf
“I Can Hear You Now: Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell”http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t212.mov
“Burning the Enterprise with BYOD” http://goo.gl/ualatx
or “Assessing the Risk of Unmanaged Devices” http://goo.gl/3icA90
“Evil DoS Attacks and Strong Defenses” http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t116.mov
“iOS Reverse #=> iPWn Apps” http://goo.gl/mvH30H
or “Attacking iOS Applications” http://goo.gl/Nm5wKq
or “Your Droid Has No Clothes” http://goo.gl/HqjVvp
“Home Invasion 2.0 – Attacking Network-Controlled Consumer Devices” http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t122.mov
“So You think Your Domain Controller is Secure?” http://myrcurial.com/conferences/defcon-21-video/2013_defcon_t220.mov
And see the full collections at:
BlackHat 2013 sessions: http://myrcurial.com/conferences/blackhat-2013-video/
Here is a BlackHat 2013 session listing: http://myrcurial.com/conferences/blackhat-2013-video/sessionlisting.pdf
(this is a big collection)
Defcon 2013 sessions: http://myrcurial.com/conferences/defcon-21-video/
Session listing: http://myrcurial.com/conferences/defcon-21-video/sessionlisting.pdf
(this is a big collection)
Derbycon 2013 Videos: http://www.irongeek.com/i.php?page=videos/derbycon3/mainlist
(this is a big collection)
Shmoocon 2013 sessions: http://myrcurial.com/conferences/shmoocon-2013/
The file names include session titles.
BSides Deleware 2013 Videos: http://www.irongeek.com/i.php?page=videos/bsidesde2013/mainlist
Louisville Infosec 2013 Videos: http://www.irongeek.com/i.php?page=videos/louisvilleinfosec2013/mainlist
BSides Las Vegas 2013 Videos: http://www.irongeek.com/i.php?page=videos/bsideslasvegas2013/mainlist
OISF 2013 Videos: http://www.irongeek.com/i.php?page=videos/oisf2013/mainlist
Hack3rcon 4 Videos: http://www.irongeek.com/i.php?page=videos/hack3rcon4/mainlist
BSides Rhode Island 2013: http://www.irongeek.com/i.php?page=videos/bsidesri2013/mainlist
Notacon 10 (2013) Videos: http://www.irongeek.com/i.php?page=videos/notacon10/mainlist
AIDE 2013: http://www.irongeek.com/i.php?page=videos/aide2013/mainlist
(AIDE==Appalachian Institute of Digital Evidence)
BSides Boston 2013 Videos: https://www.youtube.com/channel/UCmPk1vRLVFIcYjXM9lWFUHA/videos
ISSA Kentuckiana Web Pen-Testing Workshop: http://www.irongeek.com/i.php?page=videos/web-pen-testing-workshop
Outerz0ne 9 (2013) Videos: http://www.irongeek.com/i.php?page=videos/outerz0ne9/mainlist
These are excellent resources. We need to support the groups that organize these conventions, but we will never be able to participate in them all. The fact that this huge pool of resources is available 24x7x365 enhanced their value. Again, consider integrating some of them into your organization’s development planning.
Completosec Channel 