Jeff Moss introduces the Keynote and welcomes everyone tthe Amsterdam 2007 conference!
Roger will provide an overview of the work of CPNI in reducing vulnerability in information systems that form part of the UK. He will then challenge the community on a number of issues, including the development of the malicious market place, and the role security researchers in addressing vulnerabilities as used by a range of threat actors.

Until 31 January 2007 Roger Cumming was Director of the National Infrastructure Security Co-ordination Centre (NISCC), the UK centre responsible for minimising the impact of electronic attack on the UK critical national infrastructure. Since 1 February Roger has been Head of Advice Delivery and Knowledge Development at the UK Centre for the Protection of National Infrastructure (CPNI). CPNI provides protective security advice on information security as well as physical and personnel security treduce the vulnerability of the UK's national infrastructure tterrorism and other threats.

"SS7 has been a walled garden for a long time: only big telcwould be interconnected tthe network. Due tderegulation and a push toward all-IP architecture, SS7 is opening up, notably with SIGTRAN (SS7 over IP) and NGN (Next Gen Networks) initiatives.

SCTP is the protocol used tcarry all telecom signalling information on IP according tthe SIGTRAN protocol suite. It's the foundation, as TCP is the foundation for the web and email. SCTP is alsused for high-performance clusters, resources pooling and very high-speed file transfer.

When you discover open SCTP ports, you discover a secret door tthis walled garden. As a walled garden, the internal security of the SS7 network is not as good as one might expect. SCTPscan is a tool tdexactly just that, and is released as open source.

This presentation will explain how SCTPscan manages tscan without being detected by remote application, how discrepancies between RFC and implementation enable us tscan more efficiently and how we manage tscan without even being detect by systems like SANS - Dshield.org. Here we will have a look at INIT packet construction, stealth scanning and a beginning of SCTP fingerprinting.

Then, we gon tdetail upper layer protocols that use SCTP and the potentials of the SIGTRAN protcol suite in term of security. We'll see the M2UA, M3UA, M2PA, IUA which are SIGTRAN-specific protocols, and alsthe more generic SS7 protocols such as ISUP, BICC, BSSAP, TCAP, SCCP and MTP. "

"Philippe Langlois is a founder and Senior Security Consultant for Telecom Security Task Force, a research and consultancy outfit.

He founded and led technical teams in several security companies (Qualys, WaveSecurity, INTRINsec) as well as security research teams (Solsoft, TSTF).

He founded Qualys in 1999 and led the R&D for this world-leading vulnerability assessment service.

He founded Intrinsec, a pioneering network security company in 1995, as well as Worldnet, France's first public Internet service provider, in 1993.

He has proven expertise in network security, from Internet tless well known networks - X25 and other legacy systems mostly used in banking, travel and finance.

Philippe was alslead designer for Payline, one of the first e-commerce payment gateways on Internet. He has written and translated security books, including some of the earliest references in the field of computer security, and has been giving speeches on network security since 1995 (RSA, COMDEX, Interop).

Philippe Langlois is a regular contributor of french-speaking security portal vulnerabilite.com. and a writer for ITaudit, the magazine of the International Association of Internal Auditors.

Samples of the missions he has been involved with are Penetration Testing contract on multi-million live users infrastructures such as Telecom operators GSM backbone, due diligence for M&A, security architecture audits, product security analysis and advisory."

"Introduction:The following presentation is twparts, the first covers aspects of Microsoft's GS implementation and usage. The second is a complementary section dealing with ASLR in Windows Vista, its implementation and some surprising results...

Part I Synopsis: GS is a Visual Studicompiler option that was introduced in Visual Studi2002 tmitigate the local stack variable overflows that resulted in arbitrary code execution. The following paper details the methods Symantec used tassess which binaries within Windows Vista 32bit leveraged GS as a defensive mechanism. This paper presents the results of this analysis, the techniques that have been developed, and supporting material. The results in this paper are from the 32bit RTM release of Microsoft Windows Vista

Part II Synopsis: Address Space Layout Randomization (ASLR) is a mitigation technique designed thinder the ability of an attacker tachieve arbitrary code execution when exploiting software vulnerabilities. As the name implies, ASLR involves placing a computer program and its associated memory at random locations, either between reboots or executions, thinder the attacker's ability treliably locate either their shell code or other required data. This paper is the result of a brief analysis of the implementation of ASLR within Microsoft Windows Vista 32bit RTM, conducted by Symantec's Advanced Threat Research. "

"Mr Whitehouse has worked in information security both as a consultant and researcher. This has included being employed by companies in a variety of industries ranging from financial services ttelecommunications. Mr Whitehouse originally created Delphis Consulting's security practice in 1999. Mr Whitehouse joined @stake Inc in 2000 as a Managing Security Architect before becoming European Technical Director in 2004. After Symantec's acquisition of @stake Inc in 2004 Mr Whitehouse continued as Technical Manager for its professional services division in London until 2005. In mid 2005 he took a full time research role with Symantec Research Labs in Government research. Mr Whitehouse subsequently moved tSymantec's Response division joining its Advanced Threats Research team specializing in mobile platforms and related technologies.

Mr Whitehouse as previously published research on the security of mobile telecommunication networks, mobile devices and Bluetooth. In addition he has alsdiscovered numerous security vulnerabilities in a wide range of desktop and server applications. His previous research has led him tpresent at CanSecWest, RuxCON, UNCON and Chaos Communication Camp among others"

"The SMTP protocol, used in the transport and delivery of e-mail messages, includes control headers along with the body of messages which, as opposed tother protocols, are not stripped after the message is delivered, leaving a detailed record of e-mail transactions in the recipient mailbox.

Detailed analysis of SMTP headers can be used tmap the networks traversed by messages, including information on the messaging software of clients and gateways. Furthermore, analysis of messages over time can reveal organization patching policies and trends in user location and movements - making headers a very valuable resource during the target selection phase of targeted attacks."

"Lluis Mora is a researcher at Neutralbit, a research and development provider for information security vendors, where he specializes in vulnerability assessments and penetration testing of products, applications and products.

Lluis has worked in the information security field for over a decade, consulting for various service providers and corporations throughout Spain and South America. He has published various papers on vulnerability research in IT and SCADA systems and won the openhack competition back in 1999 and 2000. "

"Fuzzing is a software testing technique that consists in finding implementation bugs. Fuzzing Wi-Fi drivers is becoming more and more attractive as any exploitable security bug will enable the attacker trun arbitrary code with ring0 privileges (within victim's radicoverage).

This presentation will describe all the processes involved in the design from scratch of a fully-featured Wi-Fi fuzzer. It will pinpoint all issues and constraints when fuzzing 802.11 stacks (scanning, bugs identification, replaying bugs, analyzing kernel crashes...).

Then some features will be focused on, in order tunderstand which kind of implementation bugs may be discovered and which vulnerabilities we discovered thanks tthis tool (CVE-2006-6059, CVE-2006-6125).

Finally, a real-world example will be fully explained: how we found the first (publicly known) madwifi stack-based overflow thanks tour Wi-Fi fuzzer (CVE-2006-6332)."

Laurent is a network security expert working for France Telecom RD labs, where he works on wireless security (IEEE 802.11, IEEE 802.16...), honeypots and malwares. He alsspoke at numerous security-focused conferences (EuroSec, SSTIC, FIRST, LSM, ToorCon, ShmooCon, BlackHat...).

"When dealing with Windows exploits, an issue that often emerge is their cross-platform reliability, meaning they often work against either some given service packs of the OS, or some localization of the OS. It is quite rare tfind exploits that will work on a very wide range of Windows installs.

While multiplying the number of targets in an exploit is often the solution found in the wild, it seems that nobody has yet disclosed a solution tfingerprint a Windows language, or discuss about cross languages and service packs return addresses (though cross SP only is now fairly well mastered).

Immunity, Inc. had twork on this issue for CANVAS, in order tbuild more reliable exploits, and this paper intend texplain some of the solutions that were found tthese issues.

" Kostya is well known in the security industry for various vulnerability research projects. He is the discoverer of many software vulnerabilities which have resulted in several Microsoft patches, latest one being MS06-074, the SNMP service remote code execution. His most recent conference presentations were at Microsoft's BlueHat Fall 2006 Sessions, speaking on Skype security and at RECON'06. Kostya has joined Immunity, Inc. from the European Aeronautic Defence and Space Company (EADS), where he was a research engineer. He manages Immunity, Inc. Partners Program and does exploit development for CANVAS. Prior tthat, Kostya was manager of the French Academic CERT.

RFID is being embedded in everything... From Passports tPants. Door Keys tCredit Cards. Mobile Phones tTrash Cans. Pets tPeople even! For some reason these devices have become the solution tevery new problem, and we can't seem tget enough of them....
"Adam Laurie is Chief Security Officer and a Director of The Bunker Secure Hosting Ltd. He started in the computer industry in the late Seventies, working as a computer programmer on PDP-8 and other mini computers, and then on various Unix, Dos and CP/M based micrcomputers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention tthose areas and away from programming, starting a data conversion company which rapidly grew tbecome Europe's largest specialist in that field (A.L. downloading Services).
During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own-'Apache-SSL'-which went on tbecome the de-factstandard secure web server.
Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of re-using military data centres (housed in underground nuclear bunkers - http://www.thebunker.net) as secure hosting facilities.
Adam has been a senior member of staff at DEFCON since 1997, and alsacted as a member of staff during the early years of the Black Hat Briefings. More recently he has become interested in mobile device security, and was responsible for discovering many major Bluetooth security issues, and has alsspoken on other wireless topics such as InfraRed and Magnetic Stripes. His current interest, RFID, has spawned another Open Source project, RFIDIOt, which is alsbringing several security issues tthe fore. More detail can be found here: http://rfidiot.org"

"Today, other than doing a full static analysis of the code, the most common practice tfind vulnerabilities in your web application is tget off-the-shelf automated web scanner, point ta URL, and hope that it's doing the right thing.

But is it? How dyou know that the scanner exercised all the vital areas of your application? How accurate and complete are the results? Is relying on HTTP response the best way tfind all vulnerabilities in an application? What if there was a way tlook at what's happening inside the application while these web scanners were hitting the application?

In this talk, we'll explore that "looking inside the application as the security test runs" possibility - through byte-code instrumentation. We will see how we can use aspect oriented technologies such as AspectJ tinject security monitors directly inside a pre-compiled Java / .NET web application. We will alsgthrough a proof of concept and dem- turning a typical blackbox test inta "whitebox" test using the techniques discussed in this talk, gaining a more complete picture: gaining coverage insight, finding more vulnerabilities, weeding out false positives reported by the scanners, and gaining root cause source information.

"Toshinari Kureha is the technical lead and principal member of technical staff at Fortify Software. He oversees the development of the Red Team Workbench project. Prior tjoining Fortify, Toshinari was a technical lead at Oracle's Application Server Division, where he provided leadership in the architecture, implementation and delivery of several high-profile projects including Oracle Grid Control, Oracle Exchange, and BPEL Orchestration Designer. Prior tworking with Oracle, Toshinari worked as Lead Developer at Formal Systems a web-based computer testing and assessment system for use in the Internet/Intranet. Toshinari holds a B.S. in computer science from Princeton University.

"Kernel vulnerabilities are often deemed unexploitable or at least unlikely tbe exploited reliably. Although it's true that kernel-mode exploitation often presents some new challenges for exploit developers, it still all boils down t""creative debugging"" and knowledge about the target in question.

This talk intends tdemystify kernel-mode exploitation by demonstrating the analysis and reliable exploitation of three different kernel vulnerabilities without public exploits. From a defenders point of view this could hopefully serve as an eye-opener, as it demonstrates the ineffectiveness of HIDS, NX, ASLR and other protective measures when the kernel itself is being exploited.

The entire process will be discussed, including how the vulnerabilities were found, how they were analyzed tdetermine if and how they can be reliably exploited and of course the exploits will be demonstrated in practice.

"Long gone are the days of widespread internet attacks. What's more popular now are more directed or targeted attacks using a variety of different methods. Since most of these attacks will be a single shot styled attack attackers will often look for anyway tincrease the likelihood of success.

This is where data seepage comes in. Unbeknownst ta lot of mobile professional's laptops, pdas, even cell phones can be literally bleeding information about a company's internal network. This can be due tapplications like email clients that are set tstart up and automatically search for its mail server, windows may be attempting tremap network drives, an application could be checking for updates.

All this information can be used by an attacker tmake attacks more accurate with a higher likelihood of success. Don't laugh and dismiss this as a trivial problem with nimpact. Through demonstrations and packet caps we will show how this problem can be the weak link in your security chain. "

"The Achilles' heel of network IDSes lies in the large number of false positives (i.e., false attacks) that occur: practitioners as well as researchers observe that it is common for a NIDS traise thousands of mostly false alerts per day. False positives are a universal problem as they affect both signature-based and anomaly-based IDSs. Finally, attackers can overload IT personnel by forging ad-hoc packets tproduce false alerts, thereby lowering the defences of the IT infrastructure. Our thesis is that one of the main reasons why NIDSs show a high false positive rate is that they dnot correlate input with output traffic: by observing the output determined by the alert-raising input traffic, one is capable of reducing the number of false positives in an effective manner. Tdemonstrate this, we have developed APHRODITE (Architecture for false Positives Reduction): an innovative architecture for reducing the false positive rate of any NIDS (be it signature-based or anomaly-based). APHRODITE consists of an Output Anomaly Detector (OAD) and a correlation engine; in addition, APHRODITE assumes the presence of a NIDS on the input of the system. For the OAD we developed POSEIDON (Payl Over Som for Intrusion DetectiON): a two-tier network intrusion detection architecture.

Benchmarks performed on POSEIDON and APHRODITE with DARPA 1999 dataset and with traffic dumped from a real-world public network show the effectiveness of the twsystems. APHRODITE is able treduce the rate of false alarms from 50% t100% (improving accuracy) without reducing the NIDS ability tdetect attacks (completeness)."

DamianBolzoni received a MSc degree from the University of Venice, Italy, in Computer Science with a thesis about anomaly-based Network Intrusion Detection Systems. He has been working for a year at the Information Risk Management division in KPMG Italy. He is author of the POSEIDON and APHRODITE papers and gave talks at IWIA workshop, WebbIT and many security conferences in Netherlands. At the moment, he is a PhD student at the University of Twente, The Netherlands. His research topics are IDS and risk management.