SummerCon 2013 Review by @Hans_Bosch
SummerCon celebrated its third year in the New York metropolitan area with a baptismal rain fall that consumed the entire day. 
Luckily for us, a delicious spread of NY style deli meats, vegetables, and various types of salads where plentifully provided by IOActive. Thank you IO! We managed to have plenty of food until late in the day.
With plenty to eat and drink the time flew by quickly. My favorite talk “Bypassing all the things” by Arron Portnov kept me glued to my seat. Keeping the con as a one track event is key to Summercon. Redpantz has no inclination to changing this format as it keeps you together and focused on the presentations. Being in one place is also conducive to networking with your peers and meeting new people. At this con I meet a father and son team Bill and Bill who traveled from the Pittsburg and Catskill NY area. More on them on a later post.
The first day ended with an open bar provided by iSECpartners. Thank you iSEC again it was our good fortune that the bar was big enough to accommodate all us thirsty SummerCon veterans. If it where not for that happy hour, I would have gone broke as the prices where, well you know New York City prices (which is why I liked the Brookly venue better, sorry red).
Day two went by quickly as well with a morning shot of eye opening talks. Some very humorist as was Michael Coppola talk on home devices connected to the Internet. It would seam that hacking is dead except we now have even more target vectors, thank you!
In conclusion I enjoyed my time at Summercon, it brought me together with some old friends and I made some new ones. I even
met 2 fellas from the academic research community (brew ha ha). At least we have one thing in common we all drink! So mark you calendars for next years Summercon June 6-7, 2014.
Some other notable talks included:
Beating a less-dead horse: The current state of .NET reversing
Aloria
All the cool kids are reversing C apps, mobile is the (relatively) new hotness, and Java is a long-moldering corpse of failure. It’s time to pick on a new, somewhat neglected red-headed stepchild: .NET. This talk will cover the current state of the art in .NET reversing, down from PE format of .NET assemblies through various types of obuscation, and into reversing tools and techniques. Finally, we will get a little Inception-esque by reversing Reflector inside Reflector in an attempt to modify its behavior.
Portscanning Low Earth Orbit
Travis Goodspeed
Satellites are whirring all around our little planet, but the lack of tools for accessing them have limited past research to stationary satellites or to ones with documented communications protocols. This lecture presents the conversion of a maritime L-band dish to be controlled by a combination of open source hardware and good ol’ fashioned unix daemons. The dish is operated remotely or in a standalone fashion, scanning the neighborly skies day and night with little or no supervision.
Weighing in on Issues with Cloud Scale
Michael Coppola
No, it’s not one of those talks. In this new age of computing, more and more household devices are being connected to the Internet. TVs, refrigerators, and even coffee machines are some of the first to give in to the trend. But these devices are old news. In this talk, we’ll take a step back from the ordinary and look at a new target: a WiFi-enabled… bathroom scale? With the help of a soldering iron and our good friend IDA, we’ll have a go at reverse engineering the device as well as discuss practical attacks to achieve code execution.
Google adds (some) malware and phishing info to Transparency Report
A posting from Naked Security about Google: Google has expanded its Transparency Report data to include stats from their ‘Safe Browsing’ system, which keeps tabs on where malware and phishing sites are hosted.
The data is a little short on definition, but it does give some interesting insights into which hosting providers are doing the worst job of keeping their IP space clean.
The twice-yearly Transparency Report has traditionally covered more politically-sensitive topics – which countries are blocking access to Google services, and who’s been asking Google to provide data on their users (or “product“), or to take stuff down that might be found offensive for some reason, or in breach of copyright.
Some of this stuff is interesting in itself, not least when it very nearly names-and-shames dodgy political and judicial figures trying to abuse their authority and silence their critics.
To read more click here:
Microsoft’s Big Bucks For Bugs Ups The Ante
A Posting from Dark Reading in there Application Security section:
When Microsoft senior security strategist Katie Moussouris was asked two years ago whether Microsoft would ever consider a bug bounty program of its own, she left the door open ever so slightly on whether the software giant would abandon its longtime philosophy of not paying for vulnerability finds.
“We continue to evaluate the best way to collaborate with the research community, and we’ll let you know if anything changes there,” Moussouris said at the launch of the BlueHat Prize when Dark Reading asked her whether Microsoft would ever offer a full-blown bug bounty
To read more click here:
‘BinaryPig’ Uses Hadoop To Sniff Out Patterns In Malware
A Posting from Dark Reading in there Threat Intelligence section:
As the menagerie of malware collected by security firms continues to multiply, researchers are looking for new ways to analyze the massive data sets to find interesting information in their malware zoos.
At the Black Hat Security Briefings in late July, one trio of researchers plans to release a framework for using Hadoop and the Apache Pig platform for parallelization that makes analyzing large sets of malware programs easier. The three researchers–Zachary Hanif, Telvis Calhoun and Jason Trost of Endgame Systems–developed the framework, dubbed BinaryPig, while trying to analyze a quickly growing collection of millions of malware samples collected by the company over the past three years.
To read more click here:
Whistle-blower update: Snowden lands in Moscow; WikiLeaker’s Gmail searched
A posting from CNET News in there Security section:
Several stories involving whistle-blower/espionage suspect Edward Snowden cropped up over the weekend, including word of a U.S. demand for his extradition and that he flew to Moscow Sunday, and is likely heading for another destination. And news of a Justice Department search of a former WikiLeaks volunteer’s Gmail account has also surfaced. Here’s a quick summary:
Snowden was allowed to leave Hong Kong because a U.S. extradition request did not fully comply with Hong Kong law. He landed in Moscow early Sunday morning, but his final destination is unclear. According to a report in the New York Times, he may be headed to Ecuador, Cuba or Venezuela. Via its statement on its website and on Twitter, WikiLeaks said that it provided assistance to Snowden in his search for political asylum, and that he landed in Moscow accompanied by WikiLeaks legal advisers.”
Ecuadorean Foreign Minister Ricardo Patino tweeted: “The Government of Ecuador has received an asylum request from Edward J. #Snowden.” WikiLeaks founder Julian Assange has been the guest of Ecuador’s embassy in London for just over a year.
To read more click here:
Taking a closer look at the Glazunov exploit kit
A posting from Naked Security on Glazunov exploit kit:
The one I have chosen has been quite active of late, and has a few interesting characteristics I wanted to highlight. As it happens, I do not actually know its “official” name (as in the name assigned by the author), but it was originallychristened Glazunov by another researcher tracking it back in 2012 and the name seems to have stuck!
Compromised sites
As I am sure most readers are aware, it is typical for exploit kits to rely upon injections of iframes into legitimate web sites in order to drive user traffic to the exploit kit. This is very much the classic drive-by download scenario. For those wanting a bit more background on this type of attack, take a look at this video, which clearly explains how the process works.
To read more click here:
