BoutiqueKit Playing WarGames

Architecture and Background

BoutiqueKit: Playing WarGames with expensive rootkits and malware JOSH 'M0NK' THOMAS APPLIED RESEARCH SCIENTIST - ACCUVANT "Theoretical" targeted rootkits need to play by different rules than the common malware that ends up filling our inboxes with spam and attempting to steal our CC numbers... The costs involved of getting popped are huge in comparison, the value is in the secrecy of being truly hidden and embedded for the long term. I've spent the past year considering what the next level of rootkits would look like and how we can protect ourselves against them.

Vulnerability Analysis

This talk will cover a handful of advanced hiding mechanisms at a technical level. The talk will also touch on legal implications and existing frameworks for expensive advanced threats. Josh 'm0nk' Thomas (@m0nk_dot) Security researcher, mobile phone geek, mesh networking evangelist and general breaker of things electronic.

Exploitation and Demonstrations

Typical projects of interest span the hardware / software barrier and rarely have a UI. m0nk has spent the last year or two digging deep into Android and iOS internals, with a major focus on both the network stack implementation and the driver and below hardware interfaces. He uses IDA more frequently than Eclipse (and a soldering iron more than both).

Remediation and Defensive Strategies

His life dreams are to ride a robot unicorn on a moonlit beach and make the world a better place, but mostly the unicorn thing... Josh is currently employed by the nice people @ Accuvant LABS and the very mean people @ MonkWorks, LLC. Materials: