Studies and research

• NSS Labs Study on social attack aversion – NSS Labs released its latest study on how well web browsers avoid social engineering attacks.
• Veracode’s State of Application Security – Around 58 percent of the applications tested by application security testing service provider Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing.
• McAfee on intellectual property risks – McAfee analyzed a commonly used software for housing intellectual property called Perforce and released its findings during a session at the RSA security conference.
• Fifteen Common Activities from BSIMM2 - In addition to highlighting the fifteen most common BSIMM activities, the article also provides the 30 firm data for all 110 activities in public for the first time.

Presentations and sessions

• Visualizing the Zeus attack against government and military – This presentation will focus on specific tools and methodology to aid you in establishing security data visualization practices in your environment.
• Cryptographers Panel – Adi Shamir said that he is working with a team of researchers who have put together a paper that describes an attack that will break AES 128 within 10 rounds.
• Wisdom of ‘Foolishness’ – A panel of leading cryptographers reveal some of the lessons they have learned while making seemingly imprudent decisions.
• Pre-debate on ‘Proving the Worth of Security Metrics with Real-World Data’ – A warm up session between the panelists who are up to discuss the value of security measurements.

Some announcements and news from the conference floor

• Symantec exhibit makes cybercrime tangible – The security company gave tours of its Black Market at the RSA security conference here this week.
• DHS to extend Einstein technology to private sector – The White House did confirm this week that the latest version, called Einstein 3, involves attempting to thwart in-progress cyberattacks by sharing information with the National Security Agency.
• Microsoft wants to put infected PCs in rubber room – Charney is the latest to champion the idea that infected PC users should be put in their own rubber room, so the malware, spam, and other attacks they generate can’t harm others.
• White House outlines secret cybersecurity plan – Howard Schmidt gives a talk during a town hall meeting on how the nation will face impending attacks on the cyberspace front

Interviews (link redirect to MP3 podcasts)

• Jennifer Bayuk – She says that audits do not break down, it’s the response to it that fails.
• Mark Bower, Voltage Security – The director from Voltage Security speaks about E2EE, how it will affect merchants and what we might be seeing in the future from Voltage SecureData Payments POS SDK.
• Andy Hayter, ICSA Labs – This interview with ICSA Labs discusses about anti-virus testing, education of consumers and a new initiative to use the testing ICSA does in the real world.
• Pedro Bustamante, Panda Security – A senior analyst at Panda Security explains his company’s cloud AV product and USB vaccine.
• Scott Charney, Microsoft –  A post-talk Q&A with the VP of Trustworthy Computing at Microsoft about quarantining of infected computers away from the Internet.
• Anton Chuvakin, “Security Warrior” – Anton Chuvakin talks about PCI compliance and log management.
• Edward Haletky, Anton Chuvakin – Edward Haletky chats with Anton Chuvakin about the benefits of virtualization and the issues it faces.
• Jan Hichert, Astaro Internet Security – The CEO of Astaro shares their new security products and how they are using it in social media environments.
• Chris Hoff, Cisco – Chris Hoff explains  a bit on cloud computing and virtualization.
• Mikko Hypponen, F-Secure – The chief research officer of F-Secure converses about malware and how it is evolving to new platforms.
• Jonathan Penn, Forrester – Jonathan Penn of Forrester discusses compliance and why it isn’t equal to security.
• Marty Roesch, Sourcefire – Roesch talks on the security existential crisis, Immunet and virtual appliances.
• Bob Russo, PCI Security Standards Council – Bob Russo, general manager of PCI Security Standards Council, stresses the importance of looking at your security logs and not just turning them on.
• Roel Schouwenberg, Kaspersky Lab – A conversation with the senior AV researcher of Kaspersky on APT, signature-based APT and other topics.
• Hord Tipton, (ISC)2 – The executive director of International Information Systems Security Certification Consortium expounds on the Safe & Secure Online program and other topics.
• Jacob West, Jeremiah Grossman – Two security experts share what they see as the most common vulnerabilities out there and the incentives of the ones who exploit them.

Software downloads

• VerIS Framework – Verizon released its framework for analyzing forensics data to help give organizations a better look into their data breaches.
• Playbook – Matasano offers a virtual appliance that scans for any firewall rules that are outdated, redundant, or could potentially expose a network to security threats.
• Forefront Identity Manager 2010 – Microsoft released its new identity management software, a system corporations can use to manage employees and others within an organization.

Finally, here is the official photo set from the conference and the compilation of video and audio from the keynote presentations. Watch out for RSA Europe coming this October.

• Becoming Jack Flack: Real Life Cloak & Dagger
  A talk about how to keep your anonymity in a world that gets more and more connected each day. PDF | M4V
• An Existential Threat To Security As We Know It?
  This discussion centers on PCI, compliance and the existential threat to information security. PDF | FLV

• Flying Instruments-Only: Legal and Privacy Issues in Cloud Computing
  Here, Richard Goldberg reveals some big issues people will face as we move data to the cloud as well as what measures can be taken to protect this data. M4V
• Exposed | More: Attacking the Extended Web
  Some insights are revealed on how APIs of some websites are being exploited and what measures can be taken to reduce this risk while keeping them open for access. PDF | M4V
• The New World of Smartphone Security – What Your iPhone Disclosed About You
  This talk examines mobile to mobile attacks within cellular IP networks, the iPhone attack surface, iPhone worms, iPhone location-based gaming privacy concerns, and iPhone web application security. PDF | M4V
• The Friendly Traitor: Our Software Wants to Kill Us
  This session explores the usage of browser hooks, client provided content and malicious flash applications in attacking client machines and organizations. PDF | M4V
• Back to the Glass House
  A presentation of how virtualization technologies could be deployed to counter hacking attacks and an update on the current status of an on-going pilot deployment of these technologies with a large organization’s desktop environment. PDF | M4V
• Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications
  As the offline and online world begin to merge, new attacks shift from being temporal to persistent, giving the attacker almost an infinite array of resources to accomplish his goal. This talk breaks down the risks involved in offline technologies as well as some real-life examples. M4V

Tuesday Map:

Wednesday Map:

It’s time for the RSA Conference again! This year’s RSA Conference will be from March 1 – 5, 2010 at the Moscone Center in San Francisco. Featuring over 300 exhibitors and security vendors in the expo floor, this is one of the most comprehensive security events in the world. There will also be over 250 security sessions covering a variety of relevant topics such as darknets, the National Cyber Security Framework, cloud computing security, crowdsourcing fraud and business metrics for security and risk.

There’s a lot of info going on for this conference and we’ve compiled a few links below to help you digest it.

Catalog Brochure – A comprehensive guide of everything about the RSA Conference. Beware though, it’s in Flash but they do offer a downloadable PDF version as an alternative.
Session Catalog – A list of all the talks, speakers and schedules during the conference, all bundled in a neat, search-friendly page. There’s also a printable version of this list available.
Twitter Stream – Keep your finger on the pulse via the conference’s official Twitter feed. Use #rsac for your related tweets.
Facebook Group – Socialize with other attendees online at this site.
Agenda at a Glance –  A basic overview of all the events including the Keynotes, Peer2Peer and Track Sessions. Below is the expo schedule for a quick reference

Monday, March 1:       6 pm – 8 pm (Welcome Reception)
Tuesday, March 2:      11 am – 6 pm
Wednesday, March 3: 11 am – 6 pm
Thursday, March 4:    11 am – 3 pm

Exhibitor List – Check out if your favorite security vendor is on-site. This list includes other details like the company website, booth number and company address.
Floor Plan – You can map out your activities with this floor plan, courtesy of mapyourshow.com. This site is also in Flash so be forewarned.

If you’re interested in going to the expo floor, we can get you in for free! Register here then enter the complimentary expo pass code to save on the $100 fee! You only need to use one of these codes so just choose your favorite one from the list below.

• 3Com – SC10TPP
• ArcSight – EC10ARS
• Blue Coat – EC10BLC
• CA Security – SC10CA
• Cloud Security Alliance – 1310CLEXPO
• Collective Software – EC10CSO
• Kantara Initiative – 1310KANEXPO, select Kantara Initiative from the Registration Package page to get free access to the March 1 workshop from the company.
• Lieberman – EXH9LSC
• nCircle – SC10NCR
• PKWare – EC10PKW
• Proofpoint – EC10PRF
• Qualys – SC10QLS
• Symantec – SC10SYM, expires February 26
• Tipping Point – SC10TPP
• WebRoot – EC10WBR

We’ll be posting more about the event when it kicks of this coming March. Also check out the BSidesSanFrancisco event as well while you’re out there.

This year’s ShmooCon 2010 East coast hacker convention was a three day event at the Wardman Park Marriott, Washington DC, USA. The event took place according to schedule from Friday, February 5 to Sunday, February 7, 2010.

The central theme for day one was “One Track Mind,” a single track consisting of seven 30-minute speed talks. Day two and day three each presented three tracks: Break It!, Build It!, and Bring It On! For those that did not attend ShmooCon this year, the ShmooCon Group broadcast ShmooCon Live Streaming Video of all presentations.

As with the past three ShmooCon conventions, tickets for ShmooCon 2010 had sold out early. About 1,500 fans attended ShmooCon 2010, despite the heavy snow that blanketed the greater Washington, DC, area. This post lists links to ShmooCon 2010 related articles, blog posts, videos, photos, tools and downloads.

ShmoonCon 2010 East Coast Hacker Convention, Washington, DC, USA

• The ShmooCon 2010 schedule.
• ShmooCon’s Hacker Arcade.
• ShmooCon exclusive, Hack-or-Halo.
• The TF2 Lan Party Cheater Tourney and TF2 Tourney (Team Fortress 2- Blog).
• Full Disclosure: ShmooCon 2010 CFP – About the ShmooCon conference format and more.
• ShmooCon 2010 Washington, D.C., area map.

ShmooCon 2010 – InfosecEvents Previous Posts

• ShmooCon 2010 – Preview
• ShmooCon 2010 – Day One
• ShmooCon 2010 – Day Two
• ShmooCon 2010 – Day Three
• ShmooCon 2010 – Shmoo Photos

ShmooCon 2010 – Resources and Tools

Jsunpack-network Edition Release: JavaScript Decoding and Intrusion Detection by Blake Hartstein, Blake Hartstein.

• Download jsunpack-n.tgz.
• JavaScript unpacker Jsunpack.

Blackberry Mobile Spyware – The Monkey Steals the Berries, Tyler Shields.

• Slides: Blackberry Mobile Spyware (PDF).
• TXSBBSpy Demo by Tyler Shields at Veracode Research Lab.
• txsBBSpy.java source code.

Cracking the Foundation: Attacking WCF Web Services, Brian Holyfield.

• TFS Toys Subversion download site.
• WcfTestClient download.
• WCF Storm Free Lite Version download.

DIY Hard Drive Diagnostics: Understanding a Broken Drive, by Scott Moulton. Be sure to get your free copy of DIY Hard Drive Diagnostics (PDF). Visit Moulton’s web site, MyHardDriveDied.

Information Disclosure via P2P Networks, Larry Pesce and Mick Douglas. Check out The Cactus Project at PaulDotCom. The Cactus Project is a tool intended to be used for all sorts of purposes on the Gnutella bases P2P network.

Articles and Blog Posts

• NovaInfosecPortal’s coverage on ShmoonCon 2010 FireTalks.
• ShmooCon | Inside FarmVille’s Sinister Underbelly (CSO, Bill Brenner, Senior Editor). “You love Facebook apps like FarmVille and Mafia Wars and think they’re perfectly safe, right? Think again.”
• ShmooCon | Your iPhone’s Dirty Little Security Secret (CSO, Bill Brenner, Senior Editor). “Just how easy is it for the bad guys to use your iPhone against you . . . Trevor Hawthorn explains what to do about it.”

Videos

• ShmooCon 2010 GSM: SRSLY? by Chris Paget and Karsten Nohl. Shmoocon 2010 – Hak5, an intervew with Chris Paget via revision3 on YouTube.
  Paget, “Cloning, spoofing, man-in-the-middle, decrypting, sniffing, crashing, DoS’ing, or just plain having fun. If you can work a BitTorrent client and a standard GNU build process then you can do it all. . . .”
  • The OpenBTS Project web page.
  • OpenBTS download.
  • OpenBTS Hardware link from the OpenBTS web page.
• ShmooCon 2010 Social Zombies II: Your Friends Need More Brains by Tom Eston, Kevin Johnson, Robin Wood. Facebook Application Autopwn with BeEF, via spylogicdotnet (Tom Eston) on YouTube. Demo showing machine getting pwnd by simply viewing the profile page of a vulnerable Facebook application; particular Facebook app found vulnerable to persistent XSS (via theharmonyguy).
  • BeEF Tool (Browser Exploitation Framework) used to launch the Metasploit Browser Autopwn module to attack the victim machine.

Twitter

• There is a lot of valuable information security talk out there in the world of Twitter. The twitosphere was full of interesting streams about #shmoocon.
• OWASP BWA (Broken Web Application) Project (BWA Main Page) via ChrisJohnRiley and danphilpott. Learn about the OWASP (Main Page), DVWA, WebGoat, Matiliday, and more.
• VMWare vSphere Hardening Guide via k4l4m4r1s. This guide represents a new approach to providing security guidance.
• Secmaniac.com launched; Social Engineering Toolkit: SET v0.4 codename “pink pirate” (not making that up) talk at firetalks #shmoocon from Shpantzer

InfosecEvents’ Closing Comments

February 2010, this concludes another exciting ShmooCon East coast hacker convention; held this year at the Wardman Park Marriott, Washington DC, USA. Be sure to check back here at InfosecEvents for the latest information on hacking contests, security tools, training, vulnerabilities, workshops, and upcoming events.