Race-2-Zero Unpacked
Simon Howard details simon Howard: Race-2-Zero Unpacked Signaure-based Antivirus is dead, we want to show you just how dead it is.
Summary
Architecture and Background
Simon Howard: Race-2-Zero Unpacked Signaure-based Antivirus is dead, we want to show you just how dead it is. This presentation will detail our findings from running the Race-2-Zero contest during DC16.
Vulnerability Analysis
The contest involves teams or individuals being given a sample set of malicious programs to modify and upload through the contest portal. The portal passes the modified samples through a number of antivirus engines and determines if the sample is a known threat.
Exploitation and Demonstrations
The first to pass their sample past all antivirus engines undetected wins that round. Each round increases in complexity as the contest progresses.
Remediation and Defensive Strategies
Topics covered will include: An overview of the multi-AV engine interface Mutation / obfuscation techniques Statistical analysis of the time taken to circumvent various products Different approaches used by contestants Were viruses or exploits easier to obfuscate? Prize giving ceremony with celeb judging panel... prizes will be awarded for The most elegant solution Comedy value Dirtiest hack ... and most deserving of a beer Simon Howard With a penchant for black t-shirts, jeans and the lyrical styling of Pantera, Simon has been touching computers ever since he can remember. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.