Preliminary BlueHat6 agenda

Microsoft is having another BlueHat conference next week, and it looks like mobile security and virtualization will be hot topics there.



For those of you who don't work at Microsoft and were not invited, here's a preliminary look at the agenda. Microsoft PR tells me that this is likely to be updated on the BlueHat blog sometime in the next few days.



Some interesting talks there, including one from Roberto Preatoni of vulnerability seller  WabiSabiLabi. Wonder what he's doing there? Looking to sign up MS as a client? :-)



Here is the preliminary agenda for "BlueHat v6: The Vuln Behind The Curtain:"



BlueHat Day 1: Thursday, September 27 begins in the Conference Center/Kodiak Room



Speaker Lounge this year is in 34/Palouse so be sure to check in at the Registration Table and we'll direct you there. Live feed and goodies present.



D1 Morning Block: State of the Union

Too many boundaries.  Too little security.  Such is the theme this morning, as Mark Russinovich kicks off a methodological analysis of what our security boundaries actually represent to an attacker in "Malware, Isolation, and Security Boundaries:  It's Harder Than It Looks."  This talk will be followed by Roberto Preatoni of WabiSabiLabi's analysis of the present vulnerability analysis.  Finally, IOActive's Dan Kaminsky will demonstrate how a pervasive but ancient design fault in the web is allowing attackers to VPN into corporate networks with nothing but a lured web browser.

9:45-10:00



Opening Remarks



10:00-10:55



Malware, Isolation and Security Boundaries: It's Harder Than It Looks: Mark Russinovich (Technical Fellow, Microsoft)



10:55-11:00



-5 min break-



11:00-11:55



The Exploit Marketplace Project: Roberto Preatoni, Director of Strategy, WabiSabiLabi



11:55-12:00



5 min break-



12:00-12:55



Black Ops 2007: DNS Rebinding Attacks: Dan Kaminsky (IO Active)





D2 Afternoon Block: Info-Palooza

Lightning talks are the order of the afternoon, as a series of researchers discusses their findings.  Leviathan's Matt Miller is taking Microsoft's Phoenix framework and showing just what can happen when fully database driven analysis can be brought to bear to comprehend the behavior of complex software. Security Objective's Shane MaCaulay will follow up with Application Security visualizations built in WPF, and our very own Rob Hensing will discuss what's going on with zero day exploitation in Office.  Keep posted here for two surprise guests TBA that you won't want to miss!



1:30-1:50



TBA



1:50-2:10



TBA



2:10-2:30



An External Perspective to Extending Microsoft's Phoenix Framework: Matt Miller (Leviathan)



2:30-2:50



Automated Application Security Testing Models with Cool WPF Visualizations: Shane MaCaulay (Security Objectives)



2:50-3:10



Office 0-days and the People Who Love Them: Rob Hensing (Security Software Engineer, Microsoft)



3:10-3:15



-5 min break-



3:15-4:10



Lightning Talks-Various (10-5 min talks)



BlueHat Day 2: Friday Sept 28th:



D1 Morning Block: Morning of Mobile

Cell phones are everywhere.  Cell phone security--not so much.  Such is the message from Symantec's Ollie Whitehouse, who will be delivering "Mobile and Embedded Security:  The Elephant Under the Carpet".  Microsoft's Sean Hunt will follow up discussing particular challenges from the Cellular world.  Finally, Coseinc's Petr Matousek's talk will go into painstaking detail on the nature of building attacks against the Windows Mobile kernel.

9:45-10:00



Opening Remarks



10:00-10:55



Mobile and Embedded Security-The Elephant Under the Carpet: Ollie Whitehouse (Symantec)



10:55-11:00



-5 min break-



11:00-11:20



Cellular Safety!: Sean Hunt (SDE II, Microsoft)



11:25-11:30



-5 min break-



11:30-12:25



Subverting Windows CE Kernel For Fun And Profit: Petr Matousek (Coseinc)





D2 Afternoon Block: Cool Tools & Techniques

Virtualization, more than anything else, is preferred as a solution to all security woes.  Jeff Forristal, of SPI Dynamics, has taken the time to ask the question:  What exactly happens on the network, when virtualization comes into play?  The answers may surprise you.  Also surprising -- Sourcefire's Lurene Grenier talking about just what happens when a patch is released.  A preview:  It better be a complete fix, because every patch gets immediately reversed all the way to an exploit.  Finally, Pedram Amini and Aaron Portnoy of Tipping Point will discuss their newest network fuzzing framework, Sulley, in a talk that could only be called "Fuzzing Sucks!"

1:00-1:55



New Attacks Against Virtualized Networks: Jeff Forristal (SPI Dynamics)



1:55-2:00



-5 min break-



2:00-2:55



Microsoft's Circle of Life: Patch to Exploit: Lurene Grenier (Sourcefire)



2:55-3:00



-5 min break-



3:00-3:55



Fuzzing Sucks!: Pedram Amini & Aaron Portnoy (tippingpoint)