Black Hat Europe
October 14-17, 2014
Amsterdam Rai, The Netherlands
7/16/2014
07:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
Connect Directly
RSS
E-Mail
50%
50%

Black Hat USA 2014: Something Strange in the Neighborverse

Few words are as aptly descriptive as "malware"; cue the overused "what it says on the tin" remark. Of course, hostile software is ever evolving, and Black Hat-associated research is one of the key loci of information on monitoring, defending against, and nullifying it. With that in mind, today we'll preview a quartet of interesting malware-related Briefings from Black Hat USA 2014.

In the security world, it's a given that nation states often get the funnest (and scariest) toys. One case in point is Snake (also known as Turla and Uroboros), a highly sophisticated malware that maintains persistent access using covert communications, some of which are very difficult to detect. Sergei Shevchenko's Dissecting Snake -- A Federal Espionage Toolkit will demonstrate key aspects of Snake's functionality, including usermode-centric and kernel-centric architectures, rootkit capabilities, encrypted virtual volumes, and C&C traffic authorization.

Modern, 64-bit versions of Windows raise the bar for kernel-mode rootkits, with features like Driver Signature Enforcement and PatchGuard more capably protecting the keys to the kingdom. Plan B? Subvert the system before the OS takes control. Legacy BIOS systems lack the newer Secure Boot protections, as the Master Boot Record, Volume Boot Record, and bootstrap code all reside in unsigned sectors of disk. Come to Exposing Bootkits With BIOS Emulation to see how a combo of low-level anti-rootkit techniques, emulation, and heuristic detection logic can sniff out bootkits on these legacy systems.

Anti-virus solutions make grand claims about their effectiveness against unknown malware, but how can a user know which is most capable? One thing they could do is attend One Packer to Rule Them All: Empirical Identification, Comparison, and Circumvention of Current Antivirus Detection Techniques, in which Alaeddine Mesbahi and Arne Swinnen will run through their empirical findings, which include that A/Vs are much more effective detecting x86 than x64 malware. To keep things light, they also developed new packing techniques that render malware completely undetectable to current products.

In 2011, Rodrigo Branco, Gabriel Negreira Barbosa, et al. presented a wide range of anti-reverse engineering techniques found in malware, along with detection algorithms and statistics on prevalence. Unfortunately, the industry didn't take this information and run with it, so they're trying again with Prevalent Characteristics in Modern Malware. Armed with data from more than 12 million samples, they'll demonstrate the prevalence of more than 50 additional nondefensive characteristics found in modern malware, as well as how the malware responds to analysis. This time, their extensive malware database will hopefully get the notice it deserves.

Regular registration ends on July 26. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.