Black Hat Asia
March 24-27, 2015
Marina Bay Sands, Singapore
5/28/2014
01:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Focus on Reverse Engineering

Reverse engineering: The somewhat arcane art that helps illuminate the inner workings of proprietary systems, obfuscated or otherwise, is always a big theme at Black Hat conferences. This year, we have an impressive slate of reverse engineering-related programming.

It's often useful to interact directly with Flash memory, and it's fun when it lets you reverse engineer the embedded device to which it's connected. Flash's fragility means you have to be careful, though, making sure your edits don't cause bad blocks with faulty meta information. Reverse Engineering Flash Memory for Fun and Benefit will teach you all about that, as well as how to exploit the journaling systems of embedded devices to reconstruct a history of every operation the flash file system's ever experienced.

Until this year, there was no single, sensibly licensed disassembly framework that could handle multi-architecture machine code -- a shameful state of affairs. Quynh Nguyen Anh and cohorts decided to step in and fix this, and the result is Capstone. Come to Capstone: Next Generation Disassembly Framework to learn about this new engine's unparalleled features, and why it blows away everything that came before. Want the source? It's being released at the show.

A key feature of dynamic binary instrumentation (DBI) systems like DynamoRIO is their ability to be transparent -- undetectable to the malway binaries they're analyzing. Defeating the Transparency Feature of DBI will show how to break the transparency features of popular DBI tools, with code that presents different behaviors running on native hosts vs. DBI and VM, opening up new evasive possibilities.

Finally, what if we could find a way to expose all the similar code hidden in the millions of malware binaries stored in white-hat repositories? This could help speed the reverse engineering of new malwares related to older specimens, but past search approaches were either too broad or too specific. A Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks Over Millions of Malicious Binaries proposes a fresh solution to this dilemma, with an obfuscation-resilient ensemble similarity analysis approach that addresses polymorphism, packing, and obfuscation by estimating code sharing in multiple static and dynamic technical domains at once. Early results are impressive.

Bonus: Black Hat also has some great reverse engineering Trainings to check out. Both IDA Basic and IDA Advanced take a deep dive into that popular disassembler. They're on subsequent days, so if want the full crash course, take both. Also, Hands-On Hardware Hacking and Reverse Engineering is exactly what it says on the tin and a great way to get your hands dirty.

By the way, word to the wise: Register soon, because early-bird rates are available only until June 2. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
White Papers
More White Papers
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8370
Published: 2015-01-29
VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

CVE-2015-0236
Published: 2015-01-29
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVE-2015-1043
Published: 2015-01-29
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.

CVE-2015-1044
Published: 2015-01-29
vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.

CVE-2015-1422
Published: 2015-01-29
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) j...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.