|
Schedule subject to change (this is just a place holder at the moment).
CarolinaCon 7 will run from April 29 through May 1, 2011.
Friday: pre-Con (~2pm-5pm): Unofficial CarolinaCon Shootout
Friday: (Talks from 7pm-10pm):
5:30pm - Registration Open
6:45pm - Con kick-off/welcome - side events rules/info - AlStrowger, Uncue
7:00pm - Tales from the Crypto - G. Mark Hardy
8:00pm - How to Own and Protect Your Office Space - Dr. Tran
9:00pm - Serial Killers: USB as an Attack Vector - Nick Fury
10:00pm - Hacker Trivia - wxs, Vic Vandal, AlStrowger
11:00pm - Con closed for day, bar open
Saturday: (Talks from 10am-10pm with breaks for lunch and dinner):
9:30am - Registration Open
10:00am - Music and Audio Production with FOSS - Adam Drew
11:00am - PIG: Finding Truffles Without Leaving A Trace - Ryan Linn
12:00pm - Lunch Break
1:00pm - If You Own a Multi-Function Printer than I Own You - Deral Heiland
2:00pm - Yara and Python: The Malware Detection Dynamic Duo - mjg
3:00pm - There's An App For That: Pentesting Moble - Joe McCray
4:00pm - Fun with SSH Honeypotting - Chris Teodorski
5:00pm - Dinner Break (Conference Room will be Closed)
7:00pm - Why Your Password Policy Sucks - purehate
8:00pm - Mackerel: A Progressive School of Cryptographic Thought - Justin Troutman
9:00pm - TTL of a Penetration - Branson Matheson
10:00pm - Hacker Trivia - Vic Vandal, wxs, AlStrowger
11:00pm - Conference Room Closed for the Evening
Sunday: (Talks from 10am-5pm with a break for lunch):
10:00am - logstash: Open Source Log and Event Management - Jordan Sissel
11:00am - Dissecting the Hack: Malware Analysis 101 - Gerry Brunelle
12:00pm - Lunch Break
1:00pm - Security Lessons from Cracking Enigma - Lisa Lorenzin
2:00pm - Hack from a Library with Katana - ronin
3:00pm - The Art of (Cyber) War - wxs
4:00pm - Pwning Capture the Flag: Step by Step - David Burt
5:00pm - CarolinaCon 7 ends - Pack it up and move it out!
Talk Abstracts:
TITLE: Tales from the Crypto
PRESENTER: G. Mark Hardy
SUMMARY: Learn how to crack crypto contests like a pro. The speaker has awarded half a dozen free round-trip plane tickets to previous contest winners, and $1000 in prizes for the winners of the SHMOOCON crypto badge contest. Maybe you'll be next. From the daily newspaper puzzle to badge contests to codes that keep the National Security Agency awake at night, it all comes down to intuition, perspiration, and math skillz.
TITLE: How to Own and Protect Your Office Space
PRESENTER: Dr. Tran
SUMMARY: Most people don't need to secure their office build like a military fortress during the cold war. However, in a world of misconfigured firewalls, not so bright users, and leaky data, people forget about their front door. Who needs to 1337h4x0r into the database when a clever thug can walk in and steal stuff? To understand how to protect your office space, you should know how common inconsistencies, laziness, and neglect can lead to poor physical security. You'll learn some quick and easy ways to break into places you shouldn't be and then tell the physical security or facilities guy how to fix it.
TITLE: Serial Killers: USB as an Attack Vector
PRESENTER: Nick Fury
SUMMARY: Love it or hate it, the Universal Serial Bus is the preferred protocol for transferring files, connecting peripherals, and a host of other applications. This talk will cover the basics of using microcontrollers for the purpose of attacking a machine over USB. This talk will focus on attacking a machine through it's implementation of the USB protocol. It will also focus on how to take advantage of the trusting nature inherent in the protocol to trick software that supposedly protects against USB attacks. This talk will be given at a very high level and will not involve any code or complicated circuits but will instead focus on the basic ideas around how to accomplish these types of hacks.
TITLE: Music and Audio Production with Free and Open Source Software
PRESENTER: Adam Drew
SUMMARY: The talk consists of an overview of FOSS terms and concepts, why FOSS is important for musicians and producers, and then a lengthy live demo on the different applications available and how they work together. During the demo I create sounds, play music, and record and mix live in front of the audience. This gets people very excited. I then introduce community resources for learning more and allow time for a Q&A session.
TITLE: PIG: Finding Truffles Without Leaving A Trace
PRESENTER: Ryan Linn
SUMMARY: Whether you are an end user, administrator, or security personnel it is critical to know what information your computer systems may be disclosing. This talk will focus on practical Passive Information Gathering (PIG) and how it can be used to profile systems on a network without ever sending a packet out. Using an extensible Metasploit module, you will see how to passively gather information on a network segment leading to identification of hosts, passively fingerprinting OS versions, identify network devices, and gather basic topology information without generating traffic. This information will all be stored in Metasploit's backend database to help report, s ort, and even leverage the information for future penetration testing exercises.
TITLE: If you own a Multi Function Printer (MFP), then I own you
PRESENTER: Deral Heiland
SUMMARY: In the immortal words of that old gray Donkey "Pathetic," he said. "That's what it is. Pathetic." Back again for another year of vulnerabilities and exploitation. with a focus on Multifunction printer vulnerabilities including authentication bypass, information leakage flaws, and XSS flaws. We will be discussing attacking multifunction printer(MFP)devices both large scale business devices and small home office printers to harvest information such as usernames, email addresses, and authentication information including SMB, ftp, Email, LDAP passwords and more.
TITLE: Yara and Python: The Malware Detection Dynamic Duo
PRESENTER: mjg (Michael Goffin)
SUMMARY: Malware attacks are growing rapidly with no end in sight. People all over are doing what they can to classify and detect these attacks as quickly as possible. Malware researchers are using every tool at their disposal to mine as much data as possible about these attacks and their usage. One such tool is Yara. I'll go over what Yara is, what it can do for you, how to leverage Python to do it, and an example of malware classification and detection.
TITLE: Do Personality Traits increase the Likelihood that You will Hack?
PRESENTER: Thomas Holt (professorfarnsworth)
SUMMARY: This study will explore the relationship between psychological characteristics, such as being an introvert/extrovert, as well as peer relationships, and moral and ethical outlook to account for a range of online deviance and cybercrime using a sample of college students from a large southeastern university. Few researchers have considered how psychological characteristics, including moral decision making and Big 5 personality characteristics affect individual risk of offending. Thus, the findings will benefit computer security personnel and social scientists by exploring cyber-attacker
TITLE: Kippos and bits and bits and bits: Fun with SSH honeypotting
PRESENTER: Chris Teodorski
SUMMARY: Kippo is a medium interaction SSH honeypot. I've been running Kippo for awhile now and I've discovered some interesting and unusual things. For my talk, I will present a brief intro to Kippo, an explanation of how it works, and why I think running a honeypot is a worthwhile exercise. I'll also present the results of my experience and hopefully provide the audience with a little insight into the mind of an attacker.
TITLE: Why your password policy sucks
PRESENTER: Martin (purehate) Bos
SUMMARY: Passwords are the weakest link in any network configuration. Recent breaches have shown us some large databases of passwords and upon analyzing those passwords we have discovered that password policies are not working. Even with strict password policies in place, humans are creatures of habit and will construct passwords in the same way every time. These types of patterns are easily guessable. During this talk we will analyze the cracked passwords from 4-5 of the largest breaches in 2010-2011 including the rockyou breach, Gawker, rootkit.com, eharmoney and a few others. We will look at the most common patterns and then we will look at attacking them form a pent esters perspective. This talk will also cover some of the more advanced password cracking techniques currently used in today's penetration tests.
TITLE: Mackerel: A Progressive School of Cryptographic Thought
PRESENTER: Justin Troutman
SUMMARY: Mackerel is a cryptographic design paradigm built around the triad of implementation assurance (i.e.,green cryptography), interface accessibility (i.e.,blue cryptography), and the alignment of cryptographic and communication models (i.e., contextual and residual fragmentation). Concisely put, Mackerel is a starting point for blueprints on how to get cryptography right, make sure the right people get it, and see to it that cryptography and communication get themselves as realigned as possible. With that in mind, this can be seen as a torque wrench for tightening the bond between cryptographers, developers, and consumers - the stewards of security and privacy.
TITLE: TTL of a penetration
PRESENTER: Branson Matheson
SUMMARY: In the world of information security, it's not a matter of how anymore.. it's a matter of when. With the advent of penetration tools such as Metaspolit, AutoPwn, etc.; and day-to-day use of in-secure operating systems, applications and websites; reactive systems have become more important than proactive systems. Discovery of penetration by out-of-band processes and being able to determine the when and how to then mitigate the particular attack has become a stronger requirement than active defense. I will discuss the basic precepts of this idea and expand with various types of tools that help resolve the issue. Attendees should be able to walk away from this discussion and apply the knowledge immediately within their environment.
TITLE: logstash - open source log and event management
PRESENTER: Jordan Sissel
SUMMARY: Logstash is an open source, free, and scalable tool that can help you get a grip on your logs and events. Search and analyze your infrastructure with ease, in real-time; let logstash be a crystal ball for viewing events in your infrastructure and your business. Additionally, logstash acts as a pipeline, so you can easily automate reactions and alerts through the logstash pipeline to create a self-healing infrastructure or to fire off alerts. This talk will introduce logstash and cover how it can be used to debug and analyze problems with your infrastructure and your busi ness: centralize your event and log collection, analyze data, and correlate failures.
TITLE: Dissecting the Hack: Malware Analysis 101
PRESENTER: Gerry Brunelle
SUMMARY: Dissecting the Hack: Malware Analysis 101 is designed to be an introduction into the world of malware analysis. This presentation will begin with a brief 5 to 10 minute introduction on some malware analysis theory, followed by a live demonstration that will take the audience through an in depth behavioral and code analysis of a select piece of malware. This demonstration will include techniques using free open source tools and will include such techniques as detecting packers and unpacking, file and registry analysis, and in depth code analysis. The goal of the presentation is to give attendees a beginning background in malware analysis.
TITLE: Security Lessons from Cracking Enigma
PRESENTER: Lisa Lorenzin
SUMMARY: Among the distinguishing characteristics of a long-term, successful IT security professional are continued learning and a constant search for examples of achievements (and failures) to learn from. Way back in the late 1930's and early 1940's at team of cryptographers at Bletchley Park, an old mansion about 50 miles outside London, broke multiple supposedly unbreakable German encryption codes, primarily those created for the also "uncrackable" Enigma machines. A highly dedicated group of unconventional warriors worked ungodly hours to unravel the codes and kept their efforts secret from even their closest friends and relatives. They succeeded, and their work is thought to have shortened the war by up to two years and saved countless lives. In October 2010, we're trying to predict new attacks, address existing vulnerabilities, survive organizational politics, explain threats realistically to managers and users, implement and maintain feasible solutions, break what sometimes seem to be unbreakable behavior patterns and chop our budgets by x percent. Are there things that even grizzled and scar-bearing professionals can learn from the efforts at Bletchley that can carry over to our mission today? We'll examine what they did and how they did it to find out. Sure, it's going on 70 years later, but there are possibly surprising parallels and some real lessons for us as we strive to develop and implement effective and workable security countermeasures.
TITLE: Hack from a Library with Katana
PRESENTER: JP "ronin" Dunning
SUMMARY: Why hack from your computer when you can use someone else's? This talk will cover some of the cool stuff you can do using the Katana Portable Multi-Boot security suite on your USB flash drive from "locked-down limited-access" computers...like at libraries or coffee shop kiosks.
TITLE: Current and Future Trends in Cybercrime and Exploitation
PRESENTER: Omar Santos
SUMMARY: Miscreants are continuing to find new and innovative ways to exploit network, system, and even human vulnerabilities to steal information or do damage. This talk is about the current trends in Cybercrime and what we have recently seen within the Internet community. The data to be shared encompasses threat information and trends collected between January 2010 until present. It also provides a snapshot of the state of security for that period, with special attention paid to key security trends expected for the second half of 2011 and 2012.
|
