Thursday, October 29, 2015 3 years ago ,
The t2’15 infosec conference focuses on newly emerging information security research with a balance of topics on auditing and pen-testing, and security and defensive strategies.
Topic:Washing Away the Snake Oil of Threat Intelligence
Speaker: Dave Chismon
“Threat Intelligence” is at peak hype currently and is being seen by many organizations as the “cure for cyber”. As such, many companies are leaping on the bandwagon and selling a vast array of products under the banner of TI. However, no encompassing definition exists as to what TI is and how to use it and ensure that it is protecting the organization.
To respond to this we studied the field, in work supported by CPNI and CERT-UK, and present a model for classifying all types of threat intelligence to allow evaluation of them. We find that although much of what is being sold is unlikely to help protect organisations, there is a core idea that can, and which doesn’t have to cost money.
Topic: Windows Kernel Fuzzing
Attackers often rely on Windows kernel vulnerabilities to break out of application sandboxes and escalate privileges. To rapidly identify such vulnerabilities, we adapted techniques from browser fuzzing to assess the kernel and have reported a number of critical issues to Microsoft. All aspects of the fuzzer, from test case generation to testcase minimization are highly distributed and it produces high quality testcases for reproduction.
This talk will discuss our approach for fuzz testing the Windows kernel, from assessing the kernel’s attack surface and effective test case generation, to the design and architecture of a highly distributed fuzzer that scales to many hundreds of CPU cores.
You can register for tickets to t2’15 infosec here