Opening Remarks #
Abstract
Join us as we kick off BSidesDFW with a welcome from the organizers, a quick overview of the day, important announcements, and the information attendees need before sessions begin.
2011 Speakers
Penetration Through a Teensy Hole Human Interface Device Attack Vectors #
Abstract
Autorun.Inf isn’t working out for you anymore? Switch Blade isn’t as popular as it used to be? What do you mean it isn’t 2005? During this talk we will present the increasingly popular HID USB as well as putting together the device from start to finish. Basic Programming of the device will be covered as well as attack implementation and defense will also be covered. Although the Teensy HID does present a great attack vector it isn’t a silver bullet. The device does have some drawbacks which will be discussed during the talk. I will discuss some of the pitfalls that I have experienced in regard to device programming and implementation.
Presented By:
Wardell Motley
Steal Everything, Kill Everyone, Cause Total Financial Ruin! (Or How I Walked In And Misbehaved) #
Abstract
This is not a presentation where I talk about how I would get in or the things I might be able to do. This is a talk where I am already in and I show you pictures from actual engagements that I have been on. They say one picture is worth a thousand words I show you how one picture cost a company a million dollars and maybe even a few lives. In a community where we focus so much on the offensive I also make sure with every attack I highlight. I spend time discussing what would have stopped me. We need to know the problems but we need more talks providing solutions and that is what I hope people will get from this. I show the dangers of Social engineering and how even an employee with no SE experience can be an eBay James Bond which can cause total financial ruin to a company. These Security threats are real. So are these stories!
Presented By:
Jayson E. Street
PenTesting People: Social Engineering Integration #
Abstract
The security regimen most companies follow rarely includes the most critical element of any infrastructure – its people. The numbers don’t lie, targeted social engineering attacks are extremely effective and simple steps can be taken to immediately and consistently reduce the threat. In this presentation, Ryan O’Horo will take you into the psychology of a social engineering attack and the unfortunate truth of how unprepared companies can be against them. Critically, strategies for running social engineering test cases as part ofregular security audits and educating end-users in resisting social engineering attacks will help you integrate social engineering with your organization and shrink your attack surface.
Presented By:
Ryan O’Horo
Intro to Lockpicking #
Abstract
Intro into Lockpicking….Is there anything more to say?!
Presented By:
Doug Farre
Automating Forensic Registry Analysis with Registry Decoder #
Abstract
The registry on all Microsoft Windows versions contains a wealth of forensically interesting information including a history of attached devices, a list of user accounts, visited URLs, and much more. Unfortunately, existing tools for processing registry hives are difficult to use and leave the investigator with many complex, manual tasks. To combat these issues, we developed Registry Decoder, an open source tool that collects and analyzes Windows registry files. Development of Registry Decoder was funded by the National Institute of Justice (NIJ) in order to provide a tool that investigators of all technical ability can use to fully analyze registry contents. This tool contains two components; the first gathers registry files from a running machine in an orderly manner, including from System Restore Points and the Volume Shadow Service. The second performs analysis of collected registry hives offline and has a number of capabilities including: - Registry hive browsing and searching - Plugins to perform targeted analysis - Visualization of “differences” across registry files - Time lining of data - Automated reporting During this presentation, we will discuss the importance of the registry to incident response handling and forensics investigations, discuss how Registry Decoder compares to other registry analysis tools, and will demonstrate how Registry Decoder can be used to solve complex investigations. Attendees of the presentation will be able to immediately incorporate registry analysis into their investigative process, and will also be able to download all source code and documentation of the project from the associated Google Code repository.
Presented By:
Dr. Lodovico Marziale, PhD
Operating System Security for Specific Purpose Devices #
Abstract
Specific purpose devices, such as wireless access points and firewalls, are everywhere and provide the most different functionalities with a wide variety of hardware/software configurations. There are lots of works related to hardening techniques, but they usually focus on general purpose systems. This presentation will discuss important points related to operating system security for specific purpose systems. Among the topics are boot sequence modifications to improve the authenticity of the software in execution, kernel modifications to turn exploitation attempts into a non-reliable task and cryptography mechanisms to help protecting information. The concepts behind each of the discussed point will be explained and illustrated with Linux. The speaker experience in real-life systems with very specific hardware security design will also shared.
Presented By:
Gabriel Negreira Barbosa
Couch to CISO: A Security Leader's First 100 Days and Beyond #
Abstract
If you want to go from a sedentary life to running a marathon, you have to have a plan. If you want to go from a consulting life to owning a security program, you also have to have a plan. Much like a 'Couch to 5K' running program, that plan will require vision, persistent effort, and a clear set of goals. I'll share my plan, what has worked so far and what didn't, and how you can design your own.
Presented By:
Philip J. Beyer
Weaponizing The Smartphone: Deploying The Perfect WMD #
Abstract
The acceptance and integration of mobile phones, specifically smartphones, into our everyday life has allowed for these devices to penetrate deep into secure areas. The ability to have your phone along with you at any moment of the day feeds our needs for social media, email, business, and pleasure. This ability and access has allowed the use of smartphones to be bred into devices that rival other penetration testing hardware/software combinations. I have developed and created an OS platform package that allows penetration testers and security professionals the ability to test both physical security and technical security without being constrained by computers, cords, or the image of suspicious behavior. The WMD platform package is based on Windows Mobile 6.5 Smartphones and is executed similar to a virtual machine. The WMD package is preloaded with many of the same applications and testing tools that are included with Backtrack 4, www.backtrack-linux.org, there is no affiliation between the two projects, only the similar desire to create a single source of the latest tools, applications, and techniques used by today's security professionals integrating today's latest technologies. "Weaponizing The Smarphone: Deploying The Perfect WMD" will show the audience how to create a deployable package on a MicroSD card for use on the HTC Rhodium (AT&T Tilt2) or similar Windows Mobile 6.5 smartphone. Then using a test wireless AP, a windows server 2003 VM, and The loaded WMD Smartphone the audience will be presented with a live demonstration of some of the tools including NMap, Metasploit, and The Social Engineering Toolkit to exploit the Windows Server 2003 VM and gain administrative access. The fundamental security flaw of accepting technology to perform only for what is was "made" for without the expectation of manipulation presented by "Weaponizing The Smartphone: Deploying The Perfect WMD" will help security professionals protect their environments while stimulating "out-of-the-box" thinking.
Presented By:
Nicholas Donarski (Kizz MyAnthia)
The BIG ONE!!! How will you react?, no really, how will you and management react and what will everyone do? #
Abstract
It seems everyone is getting P0wned these days, you will too, it is only a matter of time, maybe you already have. When the BIG ONE does occur, What will you and management do? How will you and management react? Learn what you should do and how you can prepare management for the BIG ONE and how over-reaction will make the issue much worse. Information and lessons learned from a large Texas incident will be shared.
Presented By:
Michael Gough
YubiKey - So what do I do with this doodad anyway? Strong passwords at the touch of your finger! #
Abstract
YubiKeyis both a static password and a one-time password token or keyboard device. This talk will show you how to add it to LastPass, use it with TrueCrypt, and also as a long static password with nothing more than the touch of your finger.
Presented By:
Michael Gough
Tsukuri: Fitting Exploits #
Abstract
Every system one encounters is bound to hold a set of unique challenges, intention or otherwise. For an attack to be effective in these environments, it must properly fit to those circumstances. This concept of fitting, of both yourself and your opponent, is one of the most difficult aspects of any attack. Tsukuri, is the term used in Judo and Aikido that speaks exactly to the nuances and complexities of fitting. We will learn from this proven martial concept as a means to better attack systems. This talk will also revisit concepts of destabilization (kuzushi) and how attackers can leverage predictability to further compromise complex systems. Demonstrations will be made showcasing how one of the hardest components of an attack can be understood.
Presented By:
Andrew Wilson
Are There Vulnerabilities Around Your Firewall? Hell Yes, But Don’t Blame the Firewall! #
Abstract
NSS Lab’s report / expose on firewalls seemed to shine a light on the soft, dark underbelly of firewall vulnerability. With all the talk around next generation firewalls and the latest and greatest technologies, it seems that we’ve let the plain old firewall fall into, or out of, our toolset. But, the firewall is still one of the most important tools the security professional has. In this presentation, you’ll learn why the firewall isn’t to blame—you are. How you manage it, how you use it and what you do with it. Unfortunately, the role of the firewall has changed into little more than an access device and you need to recognize it. What you get out of your firewall is directly related to how you manage it.
Presented By:
Tim Woods
Investigating Coordinated Data Exfiltration #
Abstract
Data exfiltration is one of the largest threats organizations face as the leak of a single document can incur millions of dollars in damage, loss of client trust, and competitor advantages. The myriad of ways that data can leave a company’s control, including removable devices, CD/DVDs, printers, network transfers, and others, makes managements of this issue a nightmare for IT staff. Similarly, once data has left a network, attempting to retrace the steps of the exfiltration can be extremely difficult without a structured process. This process includes examination of all evidence sources as well as correlation of the information and thorough reporting. During this presentation, we will walk attendees through a real-world, in-depth data exfiltration investigation that we performed for a large organization. The result of this investigation was uncovering of coordinated data exfiltration of highly sensitive corporate data. Our demonstration will include a number of forensics analysis techniques including registry examination, time lining, determining removable device activity, file carving, web mail examination in the browser data store and memory, and a number of others. The demonstration will show how to perform these actions using a number of tools, both commercial and open source, and discuss other methods that could be used to achieve the same results. Once these techniques are shown, we will then describe how information from the evidence sources was correlated into higher level events in order to draw valid conclusions and solve a complex investigation.
Presented By:
Andrew Case
Attack and Defend: Anatomy of an Advanced Attack, and How to Defend #
Abstract
2011 has been a terrible year for companies defending against both basic and advanced attacks. The only way we can combat advanced threats in the future is by learning about the anatomy of ones we have already seen. This session will review details about the RSA/EMC breach and provide specific guidance on how to defend against these types of attacks.
Presented By:
Branden R. Williams
If - Then: The logic of analysis #
Abstract
examining the power of simple "If-Then" question asking. A general overview of what it means to ask If-Then style questions, and then examples of how to ask question will be discussed. Some of the examples will include detecting malicious network traffic, finding evil swf files based on static analysis, and profiling web browsers passively.
Presented By:
Mike Sconzo
You've been Schwimmed and your Hot Tub Hacked... by Haxorcizing #
Abstract
Embedded systems are everywhere. What happens when we stumble across an embedded system that is 'suppose' to be secure and find it is trivially easy to access the system(s), read and/or modify the configuration? Fun and mayhem for sure. Can we or anyone else take command and control? What could we do and how could we use it? This discussion focuses on a Key Card system that is supposed to control access and yet provides very little security, when it is supposed to do just that.
Presented By:
Michael Gough
Secure SDLC in the Real World: Pitfalls Discovered and Treasure Collected Along the Way #
Abstract
In "Pitfall!", a player must maneuver Pitfall Harry through a maze-like jungle to stay alive. Along the way, he must negotiate numerous hazards, try to recover treasure, and do it all in a limited time. Implementing OWASP's OpenSAMM in a large organization is kinda like playing that classic game. It's a little dangerous, requires vision, planning, and precision, and promises rewards. Like many of its size and with its mandate, the Texas Education Agency already has an SDLC. Enter Pitfall Phil. In an effort to build a stronger program, Pitfall Phil shifted the focus of TEA's application security program to align with OpenSAMM. I will present the hazards he discovered and the treasure he found while playing the game.
Presented By:
Philip J Beyer
Data Breach Notification Laws – Time for a Pimp Slap #
Abstract
Data breach notification laws have proliferated worldwide, beginning with California’s law which was enacted nearly a decade ago. As a result, citizens are increasingly receiving breach notifications and media coverage of data exposures has skyrocketed. But are these increasingly onerous laws leading to stronger information security and better decisions by citizens or are they backfiring? I’ll compare existing laws, analyze data breach notifications and explore the effects of these laws, including a review of survey data gathered from citizens and information security professionals. And I’ll discuss an alternate disclosure model which could be more effective.
Presented By:
Steve Werby
The Branden Williams School for Techies Who Can't Write Good (and Want to do Other Stuff Good Too): How to publish or get published #
Abstract
Are you embarrassed by your writing? Do you feel like your schooling let you down and you are constantly struggling to get simple thoughts articulated to an audience? Do you feel like you have much to say, but don't know how to say it? This session is designed for beginner and intermediate English writers, where we will take a fun look at writing well! If you were bored by English classes in school, I GUARANTEE you will have a different view on writing after my session. Attendees will walk away with a good baseline of common mistakes, ways to get started writing, how to get published, and laughs!
Presented By:
Branden R. Williams
Fundamental Flaws in Security Thinking #
Abstract
Our current trajectory in security is leading us straight into a brick wall. You have only to look at the number of high profile breaches to realize this is true. If we don't make changes, companies are going to start realizing they're going to be compromised no matter how much money they throw at security, so why try at all? What is it that got us to this point in history? I propose that it's fundamental flaws in how we look at security that form the most basic building block. Building blocks that are more sandstone than granite. Help me examine some of the fundamental flaws I've already discovered, help me identify additional flaws and talk about how we can change our thinking to reduce these flaws
Presented By:
Martin McKeay
Closing Remarks #
Abstract
Stick around as we close out BSidesDFW, share a few final announcements, thank the folks who made the day happen, and draw the raffle winners. We'll send everyone off with one last round of thanks to our speakers, sponsors, volunteers, and community.