aoe game review

Exploit Archaeology: Raiders of the Lost Payphones JOSH BRASHARS PENETRATION TESTER, MEMBER DC 949 Payphones. Remember those? They used to be a cornerstone of modern civilation, available at every street corner, gas station, or any general place of commerce. For decades, hackers and phone phreaks crowded around them as an altar to high technology and a means to "reach out and touch someone". Fast forward to today, most people have mobile phones. Payphones installed decades earlier are now more of a memorial to a time long gone by. Covered with grime and graffitti, forgotten, relegated to the realm of drug dealers and other undesirables. But they're still around, and they're more vulnerable than ever. This talk will review modern hacking techniques applied to retro hardware. We'll cover owning payphones and how they can be retrofitted with new technologies to turn them into the ultimate low profile hacking platform to compromise your organizations network. There will be demos of payphone hacking on stage, as well as using the payphone to intercept voice phone traffic. We'll also reveal a new tool to automate the exploitation of payphones and relate how (like with all forms of archaelogoy) learning about old platforms can help us secure modern architecture. Joshua Brashars Joshua Brashars is a penetration tester and a member of DC949. He prefers to break things instead of make them. Joshua has presented at several notable security conferences, including Toorcon San Diego, Toorcon Seattle, Thotcon, Baythreat and HOPE. Joshua has also contributed to several titles with Syngress Publishing. Twitter: @savant42

Doug Mohney: The Next Wireless Frontier - TV White Spaces More unlicensed bandwidth from TV!?! A long-term push to free up more wireless spectrum is expected to come to fruition this year as the FCC will open up unused TV channels ? dubbed ?white spaces? ? for unlicensed broadband use this fall, with full-blown availability in 2008 once the DTV transition takes place. Dell, Google, HP, Intel, Microsoft and Philips have joined together in the ?White Spaces Coalition? to lobby for a spectrum sensing technology to find open TV channels while Motorola has submitting a more conservative proposal combining a geolocation database with spectrum sensing. Microsoft has gone so far as to submit a prototype device to the FCC to allow the regulatory agency to explore and evaluate cognitive radio and spectrum sensing technologies. Is more unlicensed wireless bandwidth just around the corner? What is the promise of TV whitespace spectrum? What opportunities will there be to create new software and new devices? What are the ?gotchas? in the various proposals? What is the latest information out of the FCC on White Spaces device? "Doug Mohney is Editor-in-Chief of VON Magazine (www.vonmag.com) and a contributor to Mobile Radio Technology (www.mrtmag.com). He has been following the 700 MHz changes and white spaces happenings for three years.

James Jorasch - Hacking Las Vegas DEF CON 7.0 was held July 9-11th, 1999, in Las Vegas Nevada USA

Alexander Kornbrust - Hacking and Securing DB2 LUW Databases https://www.defcon.org/images/defcon-... DB2 for Linux, Unix and Windows is one of the databases where only little bit information about security problems is available. Nevertheless DB2 LUW is installed in many corporate networks and if not hardened properly could be an easy target for attackers. In many aspects DB2 is different from other databases, starting at the user management (normally no user/passwords in the database) to the privilege concept. With the latest versions, DB2 LUW became more and more similar to Oracle (views, commands, concepts to make more stuff query-able from the database) and allows even to run PLSQL code from Oracle databases. IBM is also cloning the insecure configuration from Oracle by granting a lot of the PLSQL packages to public. This talk will give a quick introduction into the DB2 architecture, differences to other relational database systems and the most common DB2 configuration problems. Showing a lit of available exploits and typical pentester questions (how can I run OS commands, how can I access the network or file system) will also be covered. This talk will also demonstrate SQL injection in stored procedure code inside of the database (SQL/PL and PL/SQL), how to find, exploit and fix it. The last part covers the hardening of DB2 databases. Alexander Kornbrust is the founder of Red-Database-Security a company specialized in database security. He provides database security audits, security training and consulting to customers worldwide. Alexander audited 3000 Oracle, DB2 and MSSQL instances over the last years. Alexander is also the co-author of the book "SQL Injection Attacks and Defense ". Alexander has worked since 1992 with Oracle and his specialties are the security of databases and secure software architectures. In the last 7 years Alexander has reported more than 1200 security bugs to Oracle and gave various presentations on security conferences like Black Hat, Defcon, Bluehat, HITB,... Twitter: @kornbrust

Automating packer and compiler/toolchain detection can be tricky and best and downright frustrating at worst. The majority of existing solutions are old, closed source or aren’t cross platform. Originally, a method of packer identification that leveraged some text analysis algorithms was presented. The goal is to create a method to identify compilers and packers based on the structural changes they leave behind in PE files. This iteration builds upon previous work of using assembly mnemonics for packer detection and grouping. New features and analysis are covered for identification and clustering of PE files. Speaker Bio: Mike Sconzo has been around the Security Industry for quite some time, and is interested in creating and implementing new methods of detecting unknown and suspicious network activity as well as different approaches for file/malware analysis. This includes looking for protocol anomalies, patterns of network traffic, and various forms of static and dynamic file analysis. He works on reversing malware, tool creation for analysis, and threat intelligence. Currently a lot of his time is spent doing data exploration and tinkering with statistical analysis and machine learning.

SensePost - Putting The Tea Back Into CyberTerrorism Putting The Tea Back Into CyberTerrorism Many talks these days revolve around cyber terrorism and cyber warfare. Some experts suggest such attacks could be effective - others say that targetted country-wide cyberterrorism is just for the movies...or a Tom Clancy book. In this talk we look at very practical examples of possible approaches to Internet driven Cyber Warfare/Terrorism. The talk will include an online demo of a framework designed to perform closely focussed country-wide cyber attacks. Roelof Temmingh is the technical director of SensePost where his primary function is that of external penetration specialist. Roelof is internationally recognized for his skills in the assessment of web servers. He has written various pieces of PERL code as proof of concept for known vulnerabilities, and coded the world-first anti-IDS web proxy "Pudding". He has spoken at many International Conferences and in the past year alone has been a keynote speaker at SummerCon (Holland) and a speaker at The BlackHat Briefings (New Orleans). Roelof drinks tea and smokes Camels. Haroon Meer is one of SensePost's senior technical specialists. He specializes in the research and development of new tools and techniques for network penetration and has released several tools, utilities and white-papers to the security community. He has been a guest speaker at many Security forums including BlackHat Briefings (New Orleans). Haroon doesn't drink tea or smoke camels. Charl van der Walt is a founding member of SensePost. He studied Computer Science at UNISA, Mathematics at the University of Heidelberg in Germany and has a Diploma in Information Security from the Rand Afrikaans University. He is an accredited BS7799 Lead Auditor with the British Institute of Standards in London. Charl has a number of years experience in Information Security and has been involved in a number of prestigious security projects in Africa, Asia and Europe. He is a regular speaker at seminars and conferences nationwide and is regularly published on internationally recognized forums like SecurityFocus. Charl has a dog called Fish.

FOE -- Feeding Controversial News to Censored Countries (Without Using Proxy Servers) Sho Ho Software Engineer, Broadcasting Board of Governors Certain countries are banning their Internet users from accessing websites that are deemed inappropriate by their officials. News organizations' websites are commonly blocked by these countries, and there are little these organizations can do to reach their audience inside those countries. FOE is a new anti-censorship tool developed in-house by the Broadcasting Board of Governors (which oversees Voice of America, Radio Free Europe, Radio Farda, Radio Free Asia, etc.), which main goal is to create a multi-platform (including mobile) architecture that allow Internet users in censored countries to receive unbiased news. Sho Ho had been a freelance software developer for about 10 years and recently joined the Broadcasting Board of Governors, the Federal Government agency that oversees and supports broadcasters such as Voice of America, Radio Free Asia, Radio Free Europe, etc. Sho is a member of the Internet anti-censorship team at BBG whose duties include developing and managing anti-censorship technologies to help Internet users in censored countries to bypass Government censorships. For copies of the slides and additional materials please see the DEF CON 17 Archive here: https://defcon.org/html/links/dc-arch...

Kenneth Geers - Live Fire Exercise: Baltic Cyber Shield 2010 In May, 2010, the Cooperative Cyber Defence Centre of Excellence in Estonia and the Swedish National Defence College hosted the Baltic Cyber Shield (BCS) international cyber defense exercise (CDX). For two days, six Blue Teams from northern European government, military and academic institutions defended simulated power generation companies against a Red Team of twenty hostile computer hackers. The scenario described a volatile geopolitical environment in which newly hired network security personnel were immediately forced to defend Critical Information Infrastructure (CII) from cyber attacks sponsored by a non-state, terrorist group. This presentation covers the origin and evolution of CDXs and it describes the design, goals, and lessons learned from BCS 2010. Kenneth Geers works for the Naval Criminal Investigative Service (NCIS), and is the U.S. Representative to the Cooperative Cyber Defence Centre of Excellence (CCD CoE) in Tallinn, Estonia. He has served as an intelligence analyst, a French and Russian linguist, and computer programmer in support of arms control initiatives. Kenneth has published strategic and technical papers on the growing connection between computer security and national security. He is a PhD student at the Tallinn University of Technology, and is a Certified Information Systems Security Professional (CISSP). For copies of the slides and additional materials please see the DEF CON 18 Archive here: https://defcon.org/html/links/dc-arch...

Ed Schaller - Exploiting WebSphere Application Server's JSP Engine WebSphere Application Server (WAS), IBM's Java Enterprise Edition (JEE) application server, is one of the leading application servers and is the predominate application server in the financial and insurance sectors. It is also embedded in several of IBM's other products including WebSphere Portal, WebSphere Process Server and WebSphere Message Broker. In March 2009, IBM released PK81387 which patches a "Possible application source file exposure" in WAS. Detailed explanation of this vulnerability and it's exploitation will be provided including how implementation details such as character encoding and multiple vulnerabilities, some still unpatched, can be orchestrated to provide file and directory exposure inside a applications Web Archive (WAR). In some cases, with common libraries or WAS feature use, these vulnerabilities can be extended to achieve arbitrary code execution resulting in full compromise of the application server. Exploitation details will be described and use of this vulnerability and others to execute a remote operating system shell will be demonstrated. Source code to the exploit and other tools will be provided. Ed Schaller has had a long interest in computer security from both the defensive and offensive angles. Before professionally focusing on security, he worked as systems administrator, developer and architect at various companies. In his security work, he was a researcher at Brigham Young University's Internet Security Research Laboratory and is now employed by a health insurance company doing security assessments on both internally developed and third party applications and systems. Most of his current work involves Java applications running on IBM's WebSphere Application Server. Outside of work, Ed is married and has three small children, who, given their current ability to get into things at home, are destined to be great hackers. For copies of the slides and additional materials please see the DEF CON 18 Archive here: https://defcon.org/html/links/dc-arch...

Roger Dingledine: Tor and blocking-resistance Tor project, an anonymous communication system for the Internet that has been funded by both the US Navy and the Electronic Frontier Foundation. Roger Dingledine is a security and privacy researcher. While at MIT he developed Free Haven, one of the early peer-to-peer systems that emphasized resource management while retaining anonymity for its users. He is best known for leading the Tor project, an anonymous communication system for the Internet that has been funded by both the US Navy and the Electronic Frontier Foundation. He organizes academic conferences on anonymity, speaks at such events as Blackhat, Defcon, O'Reilly ETech, Toorcon, 21C3, and What the Hack, and also does tutorials on anonymity for national and foreign law enforcement.

The spike of i(Phone, Pod Touch, Pad), Android, and other mobile devices that do not support Flash has spurred the growth and interest in HTML5, even though the standard is still evolving. The power of HTML5 allows developers to create almost full-fledged web applications, not just structured content. HTML5's new features has increased the attack surface. It has been demonstrated that the HTML5 offline application cache can be abused. In addition, the support for client-side storage will open up the opportunity for SQL injection attack on client machines. There has been chatter regarding the new attack opportunities that the audio, video, and canvas tags will present, considering they require JavaScript and image-related functions such as SVG. This presentation will demonstrate the issues of HTML5 and how they can be abused and mitigated with good-old techniques. This presentation will also delve into the writing malicious web pages with web workers, abusing cross-origin JavaScript requests, how not to do cross-document messaging, and abusing geolocation. Ming Chow is a Lecturer at the Tufts University Department of Computer Science. His areas of interests are computer security, game development, web application security, and Computer Science in Education. He was also a web application developer for ten years at Harvard University for University Operations Services. Ming co-edited a special issue of IEEE Security & Privacy on securing online games with Gary McGraw of Cigital, Inc. published in May 2009. Ming is a frequent guest speaker and have spoke at numerous organizations, including the New England Chapter of the High Technology Crime Investigation Association (HTCIA-NE), the Greater Boston Chapter of the Association of Certified Fraud Examiners (ACFE), the Massachusetts Office of the Attorney General (AGO), and OWASP. Ming mentored a team of students from Tufts to the Microsoft Imagine Cup Game Design Competition US Finals in 2010. Finally, Ming is a SANS GIAC Certified Incident Handler (GCIH). Twitter: tufts_cs_mchow

Decius - Exploiting Internet Surveillance Systems For many years people have been debating whether or not surveillance capabilities should be built into the Internet. Cypherpunks see a future of perfect end to end encryption while telecom companies are hard at work building surveillance interfaces into their networks. Do these lawful intercept interfaces create unnecessary security risks? This talk will review published architectures for lawful intercept and explain how a number of different technical weaknesses in their design and implementation could be exploited to gain unauthorized access and spy on communications without leaving a trace. The talk will explain how these systems are deployed in practice and how unauthorized access is likely to be obtained in real world scenarios. The talk will also introduce several architectural changes that would improve their resilience to attack if adopted. Finally, we'll consider what all this means for the future of surveillance in the Internet - what are the possible scenarios and what is actually likely to happen over time. Decius works in the computer security industry. His job consists mostly of having meetings with people and filling out forms. He used to do a lot of patch reversing but he doesn't have time any more. He has spoken at Blackhat Federal, Electronic Frontier Forums, H.O.P.E., Summercon, Phreaknic, Interz0ne, and Outerz0ne. He likes beer, particularly if it is from Bavaria. For copies of the slides and additional materials please see the DEF CON 18 Archive here: https://defcon.org/html/links/dc-arch...

The Dark Tangent & Joe Grand - Welcome and Making the DEF CON 18 Badge For the fifth year in a row, the DEFCON Badge makes its appearance as a full-fledged, active electronic system. Pushing fabrication techniques to the limit and using some components that are so new they barely exist, the design of this year's badge took some serious risks. Did they pay off? If you're in this talk and not standing in a long line to get your badge, then the answer is "Yes!" Join Kingpin as he guides you through the entire process of the badge, from initial concept to prototype electronics to firmware design to manufacturing, and all of the problems and challenges he faced along the way. Joe Grand, also known as Kingpin, is an electrical engineer and hardware hacker. He has had the honor of designing the DEFCON badge for the past five years. Back in the day, he was a member of L0pht Heavy Industries and was a co-host of Discovery Channel's Prototype This.

Matt Fiddler & Marc Weber Tobias: High Insecurity: Locks, Lies, and Liability Matt Fiddler leads a Threat Management Team for a Fortune 100 Organization. Mr. Fiddler's research into lock bypass techniques have resulted in many public and private disclosures of critical lock design flaws. Mr. Fiddler began his career as an Intelligence Analyst with the United States Marine Corps. Since joining the commercial sector in 1992, he has spent the last 15 years enhancing his extensive expertise in the area of Unix and Network Engineering, Security Consulting, Computer Forensics, and Intrusion Analysis. Currently Mr. Fiddler is the Connecticut Chapter President and active Board Member of Locksport International. Marc Weber Tobias is an investigative attorney and security specialist living in Sioux Falls, South Dakota. He represents and consults with lock manufacturers, government agencies and corporations in the U.S. and overseas regarding the design and bypass of locks and security systems. He has authored five police textbooks, including Locks, Safes, and Security, which is recognized as the primary reference for law enforcement and security professionals worldwide. The second edition, a 1400 page two-volume work, is utilized by criminal investigators, crime labs, locksmiths and those responsible for physical security. Marc is a member of a number of professional security organizations, including the American Society of Industrial Security (ASIS), Association of Firearms and Tool Marks Examiners (AMatt Fiddler leads a Threat Management Team for a Fortune 100 Organization. Mr. Fiddler's research into lock bypass techniques have resulted in many public and private disclosures of critical lock design flaws. Mr. Fiddler began his career as an Intelligence Analyst with the United States Marine Corps. Since joining the commercial sector in 1992, he has spent the last 15 years enhancing his extensive expertise in the area of Unix and Network Engineering, Security Consulting, Computer Forensics, and Intrusion Analysis. Currently Mr. Fiddler is the Connecticut Chapter President and active Board Member of Locksport International.FTE), American Polygraph Association (APA) and American Association of Police Polygraphists (AAPP)

Joe Grand: Making of the DEFCON 15 Badge Joe Grand is an electrical engineer, prominent speaker, and prolific inventor with multiple pending patents and over a dozen commercially available products. He is the President of Grand Idea Studio, a San Francisco-based product research, development, and licensing firm, where he specializes in the design of consumer electronics and video game accessories. Involved in computers and electronics since the age of 7, Joe has had the fortune of being a member of the legendary Boston-based hacker collective L0pht Heavy Industries, testifying before the United States Senate Governmental Affairs Committee under his nom de hack, Kingpin, and being praised as a "modern day Paul Revere" by the Senators for his research and warnings of computer security weaknesses. Recognized for his unconventional approaches to product development and licensing, Joe is also a well-known hardware hacker, the author of two books, contributor to four others, on the technical advisory board of MAKE Magazine, and is a co-host of an upcoming engineering show for Discovery Channel.

Rich Murphey, PhD: Windows Vista Log Forensics Event logging in Windows Vista is quite different in terms of the way events are stored on disk and the way they are used by applications. Vista uses a new encoding of event records that lends itself to much broader flexibility for searching events. This encoding has a direct impact on forensic examination of event logs, which will be discussed in this presentation. The impact of the new application programming interface (API) is no less important. A primary role of the event log is support for debugging and tech support resolution. Such debugging information, in turn, provides significant value to forensic analysis where it indicates chronological traces of user activity. The new API offers far more dependable and detailed capabilities for monitoring. To the degree that this API motivates more pervasive debugging information, Vista event logs may provide greater capability to reconstruct timelines of user activity. During the presentation, sample Vista logs will be examined from a forensics perspective. Finally, the impact of these issues on relevant forensic tools will be explored. Rich Murphey was a founding core team member of FreeBSD and XFree86. He received a PhD in Electrical and Computer Engineering from Rice University, was on the Faculty of the University of Texas Medical School in Galveston, and was Chief Scientist at PentaSafe Security Technologies. He currently works in the fields of Digital Forensics and Intrusion Prevention Systems.

Martyn Ruks: MQ Jumping Every day billions of dollars pass through middleware, the unglamorous component of most enterprise applications. Middleware may be unglamorous, but even if billions of dollars doesn't interest you, it's bound to attract someone's interest sooner or later. Often security is addressed in the front-end web server and back-end database but the other components are often ignored. The reason for this can be a lack of understanding of the risks or lack of knowledge of the middleware products and how they can be attacked. One important property of a multi-tier environment is the ability to reliably pass data between authorised system components and therefore messaging software is often required. A popular and widely deployed example of such a component is IBM's Websphere MQ (formally MQ Series). This software can be run across a number of platforms including Microsoft Windows, commercial and Open Source UNIX platforms and IBM \u2019s z/OS and i5 Operating Systems. Companies use the technology to pass messages between application components and it is widely deployed across a wide range of industry sectors including Finance, Retail, Healthcare and many others. During penetration tests conducted by MWR InfoSecurity against its clients it has been discovered that the security features provided by the product are either not utilised correctly or are not suitable for their intended use. This presentation will uncover the truth behind Websphere MQ security as it is deployed in the real world and will look at how the software can be abused by an attacker resulting in remote code execution. The talk will focus on methods for analysing the security controls that can be used to protect an installation of MQ and the limitations of each of them. Following on from this section of the talk a number of methods will be presented for compromising both the message data and the Operating System through the MQ service. This will culminate in a demonstration of some of the attacks presented in the talk, followed by a discussion about the methods that exist for protecting an installation and ensuring that security breaches do not occur. Martyn Ruks is an information security professional working for MWR Infosecurity in the UK. His primary interest is in weird networking protocols and the software that use them. His interest in Websphere MQ arose after being asked to test an installation for a client and the results encouraged him to investigate further. Martyn spoke at Defcon last year about IBM Networking Security and the fact that this year's talk is about Websphere MQ is just coincidence, or maybe its the fact that IBM occupy the office next to his, either way he hopes to show you cool stuff you can do when you produce your own code that communicates with someone else's software.

Bruce Sutherland - How To Get Your Message Out When Your Government Turns Off The Internet https://www.defcon.org/images/defcon-... How would you communicate with the world if your government turned off the Internet? Sound far-fetched? It isn't. It already happened in Egypt and Lybia and the US Congress is working on laws that would allow it to do the same. In this talk we'll explore how to get short messages out of the country via Email and Twitter in the event of a national Internet outage. Remember, data wants to be free. Bruce Sutherland is a network systems architect and software developer with Domex Computer Services Inc, based in Melbourne Beach, FL. Bruce has worked in the industry for over 20 years and has recently been working on building and hardening web-based applications. He has been an amateur radio operator since 2003 and enjoys making contacts worldwide via amateur radio satellite and on the traditional HF bands.

Michael Schearer : The Church of WiFi Presents: Hacking Iraq What in the world is a U.S. Navy officer (a Naval Flight Officer, no less) doing in the middle of Iraq? Electronic warfare, of course! The Church of WiFi presents an unclassified presentation of theprez98's experiences during his 9-month tour in Iraq. Embedded with Army units on the ground, theprez98 brought his expertise in electronic warfare to bear against the biggest threat to coalition forces - the improvised explosive device (IED). He will explore the communications infrastructure and the brief history of the Internet in Iraq. Furthermore, drawing on his background as an EA-6B Electronic Countermeasures Officer, he will explain the counter-IED fight in Iraq. Finally, he will discuss the prospects for the future. Michael Schearer ("theprez98") is an active-duty EA-6B ECMO. He flew combat missions during Enduring Freedom, Southern Watch, and Iraqi Freedom. He took his EW specialty to Iraq, where he embedded with Army units. While at Penn State, he is actively involved in IT issues. He is a licensed amateur radio operator, an active member of the Church of WiFi and a regular on the DEFCON and NetStumbler forums. He lives in Pennsylvania with his wife and 3 kids.

Attacking TPM Part 2: A Look at the ST19WP18 TPM Device Chris Tarnovsky Flylogic, Inc. The STMicroelectronics ST19WL18P TPM die-level analysis. Companies like Atmel, Infineon and ST are pushing motherboard manufacturers to use these devices. End-users trust these devices to hold passwords and other secrets. Once more, I will show you just how insecure these devices are. Christopher 'Biggun' Tarnovsky owns Flylogic, Inc. and specializes in analysis of semiconductors from a security "how strong is it really" standpoint. Flylogic offers detailed reports on substrate attacks which define if a problem exists. If a problem is identified, we explain in a detailed report all aspects of how the attack was done, level of complexity and so on. This is something we believe is unique and allows the customer to then go back to the chip vendor armed with the knowledge to make them make it better (or possibly use a different part).