Black Hat USA
July 30 - August 4, 2016
Mandalay Bay | Las Vegas, NV
Black Hat Europe
November 1-4, 2016
London UK
Black Hat Asia
March 28-31, 2017
Singapore
7/16/2014
07:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Something Strange in the Neighborverse

Few words are as aptly descriptive as "malware"; cue the overused "what it says on the tin" remark. Of course, hostile software is ever evolving, and Black Hat-associated research is one of the key loci of information on monitoring, defending against, and nullifying it. With that in mind, today we'll preview a quartet of interesting malware-related Briefings from Black Hat USA 2014.

In the security world, it's a given that nation states often get the funnest (and scariest) toys. One case in point is Snake (also known as Turla and Uroboros), a highly sophisticated malware that maintains persistent access using covert communications, some of which are very difficult to detect. Sergei Shevchenko's Dissecting Snake -- A Federal Espionage Toolkit will demonstrate key aspects of Snake's functionality, including usermode-centric and kernel-centric architectures, rootkit capabilities, encrypted virtual volumes, and C&C traffic authorization.

Modern, 64-bit versions of Windows raise the bar for kernel-mode rootkits, with features like Driver Signature Enforcement and PatchGuard more capably protecting the keys to the kingdom. Plan B? Subvert the system before the OS takes control. Legacy BIOS systems lack the newer Secure Boot protections, as the Master Boot Record, Volume Boot Record, and bootstrap code all reside in unsigned sectors of disk. Come to Exposing Bootkits With BIOS Emulation to see how a combo of low-level anti-rootkit techniques, emulation, and heuristic detection logic can sniff out bootkits on these legacy systems.

Anti-virus solutions make grand claims about their effectiveness against unknown malware, but how can a user know which is most capable? One thing they could do is attend One Packer to Rule Them All: Empirical Identification, Comparison, and Circumvention of Current Antivirus Detection Techniques, in which Alaeddine Mesbahi and Arne Swinnen will run through their empirical findings, which include that A/Vs are much more effective detecting x86 than x64 malware. To keep things light, they also developed new packing techniques that render malware completely undetectable to current products.

In 2011, Rodrigo Branco, Gabriel Negreira Barbosa, et al. presented a wide range of anti-reverse engineering techniques found in malware, along with detection algorithms and statistics on prevalence. Unfortunately, the industry didn't take this information and run with it, so they're trying again with Prevalent Characteristics in Modern Malware. Armed with data from more than 12 million samples, they'll demonstrate the prevalence of more than 50 additional nondefensive characteristics found in modern malware, as well as how the malware responds to analysis. This time, their extensive malware database will hopefully get the notice it deserves.

Regular registration ends on July 26. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.