Making Fun of Your Malware
Michael Ligh and Matthew Richard explores making fun of your malware at DEF CON 17, examining threat-intelligence and practical defenses.
Summary
Architecture and Background
Making Fun of Your Malware Michael Ligh Malicious Code Analyst, iDefense Matthew Richard Malicious Code Operations Lead, Raytheon Corporation Would you laugh if you saw a bank robber accidentally put his mask on backwards and fall into a man hole during the getaway, because he couldn't tell where he was going? Criminals do ridiculous things so often, its impossible to capture them all on video. Rest assured, when the criminals are malware authors, we can still make fun of them through evidence found in pictures, binary disassemblies, packet captures, and log files. This talk evenly distributes technical knowledge and humor to present the funniest discoveries related to malware authors and the fight against their code.
Vulnerability Analysis
Michael Hale Ligh is a malicious code analyst at Verisign iDefense. He specializes in designing tools for malware detection, decryption, and investigation. Michael obtained his masters in forensic computer investigation in 2004 and began providing Internet security services to financial institutions. He then gained interest in vulnerability research and has been credited with locating critical flaws in products such as Tumbleweed MailGate, Novell iMonitor/eDirectory, Symark PowerBroker, and F5 FirePass SSL VPN.
Exploitation and Demonstrations
Michael is a member of ZERT and has submitted winning entries in malware related contests/challenges run by SANS, Honeynet, and Hacker Challenge. Matt Richard is Malicious Code Operations Lead at Raytheon Corporation. At Raytheon he is responsible for analyzing and reporting on samples of unknown malicious code and other suspicious activity. Matt was previously Director of Rapid Response at iDefense.
Remediation and Defensive Strategies
For 7 years before that, Matt created and ran a managed security service used by 130 banks and credit unions. In addition he has done independent forensic and security consulting for a number of national and global companies. Matt has written a number of tools including a web application testing tool, log management and intrusion detection application and an automated Windows forensics package. Matt currently holds the CISSP, GCIA, GCFA and GREM certifications. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·52 min
Richard Thieme
Richard Thieme explores hacking biohacking and the future of humanity at DEF CON 17, examining threat-intelligence and practical defenses.
Main Stage·41 min
Matt Richard · Steven Adair
Matt Richard and Steven Adair explores 0-day gh0stnet at DEF CON 17, examining threat-intelligence and practical defenses.
Main Stage·41 min
Mark Ryan Del Moral Talabis
Mark Ryan Del Moral Talabis explores dangerous minds the art of guerrilla data mining at DEF CON 17, examining threat-intelligence and practical defenses.