Saturday, August 02, 2003

Thoughts on Black Hat USA 2003

Yesterday I returned from Black Hat USA 2003 Briefings and Training. I had a good time teaching Ultimate Hacking: Expert to 70 students. Props to Tim Mullen of AnchorIS.com for providing music during Sunday's setup! Remember you can view the Real Video versions of these presentations at Black Hat's multimedia archives, generally 3-6 months after the conference airs. On Wednesday, I attended the following briefings:


Wednesday night I stayed up until 2 am writing a book proposal, but I managed to wake up in time for a conference call on the Center for Internet Security FreeBSD benchmark. After that, I turned back to Black Hat:


  • Bruce Schneier of Counterpane gave Thursday's keynote. (His company has received funding of $7 mil in April 2000, $27 mil in May 2000, $24 mil in November 2000, and $20 mil in January 2003, perhaps showing his model of managed monitoring is unprofitable?) Bruce was very interesting, drawing on ideas from his new book Beyond Fear.

  • Ofir Arkin of Sys-Security spoke (.pdf) about Xprobe2, deftly criticizing an audience member who defended nmap's fingerprinting techniques.

  • FX of Phenoelit shocked everyone with his discoveries (.pdf) of how to remotely sniff Cisco switches offering UDP echo. Awesome. UPDATE: Here is the code to do remote sniffer on Cisco routers running IOS 11.x and offering UDP echo. Second Update: FX mentioned something James Bamford said, for which I found the source: "The NSA hired people from companies such as Cisco Systems, and these are people who built the Internet infrastructure in the first place, and then they go to work for the NSA and lay out the blueprint for how to tap into the Internet. They reverse-engineer, find out how the system works and work out how to use the information."

  • Jan K. Rutkowski spoke (.pdf) about detecting Windows 2000 rootkits. I took a lot of notes since his slides didn't say much. Jan wrote this Phrack article on "execution path analysis" for Linux.

  • Greg Hoglund of HBGary.com discussed (.pdf) runtime decompilation of binaries, mainly using his company's software. His company supports two open source projects, Restart, and Speedbreak, which haven't released any files yet. He also mentioned VMADump, part of the BProc application, for dumping memory for analysis.