Black Hat Europe 2013

Today is the last day of reports ( March 14-15 ) at the Black Hat Europe 2013 conference. As usual, at events of this kind reports are presented with interesting content, and this year is no exception. A list of speakers can be found here . This time the conference was held in Amsterdam. Black Hat gained fame for several reasons, for example, many reports in different years laid the trends of development of some areas in the field of security analysis. In addition, he is a well-known conference, which offers material from various areas of security analysis, which has not been published before.



One of the interesting reports, in our opinion, presented Zhenhua 'Eric' Liu, a specialist company Fortinet. His report was called "Advanced Heap Manipulation in Windows 8" .
')
The report is devoted, in particular, to operating the kernel pool in kernel mode and obviously can serve as a good addition to the already very popular Tarjei Mandt material (aka kernelpool) - “Kernel Pool Exploitation on Windows 7” , which can be viewed here . Unlike the report Tarjei Mandt , the new material covers the operation of the pool on Windows 8. Also, this report includes a demonstration of the operation of the user mode heap. Full report .

Zhenhua Liu will be on Wednesday, March 15th at 2:00 pm Its research paper entitled: “Advanced Heap Manipulation in Window 8”. Inspired by the infamous "heap Feng Shui" technique, it is therefore recommended by built-in Windows 8 exploit mitigation improvements.

Another interesting report was presented by Nikita Tarakanov (NTarakanov) and Oleg Kupreev . Their analysis was called "Huawei - from China with Love" . It deals with Huawei 's modems and vulnerabilities in the firmware that comes with them, leading to their potential exploitation. The full report can be found here .

3G / 4G networks are getting more and more these days. Most of users nowadays have USB 3G / 4G modems - they're small, easy-to-use and pretty cheap. That's why we started this research. An idea to find out the way to infect as much as possible.
If you are using a USB device, it’s not a problem. This is a world wide botnet: you can use USB modems.

Rafal Wojtczuk and Rahul Kashyap presented a report on the possible exploitation of modern sandboxes. The study is called “The sandbox roulette - are you ready for the gamble?” . It provides notes on possible vulnerabilities in various types of sandboxes. The report itself can be viewed here . We consider the architecture of various types of sandboxes, for example, Sandboxie and built-in sandbox in Google Chrome browser.

This section will be an in-depth, security focused, technical analysis of the application sandboxing technologies available today. It will be consistent, measurable, and understandable for both IT administrators and security specialists. In this case, you can explore each of the major commercially available sandbox flavors. It will be your business activity.

Papers presented at the conference can be found here .