The Dirty South
David Kennedy and Nick Hitchcock explores the dirty south at DEF CON 21, examining tor-network and practical defenses.
Summary
Architecture and Background
The Dirty South -- Getting Justified with Technology DAVID KENNEDY FOUNDER & PRINCIPAL SECURITY CONSULTANT, TRUSTEDSEC NICK HITCHCOCK SENIOR SECURITY CONSULTANT, TRUSTEDSEC It seems that every day there's a new NextGen firewall, whitelisting and blacklisting, DLP, or the latest technology thats suppose to stop us. But does it really stop "hackers"? Truth is, naw not really. In this talk we'll be showing off the latest bypass techniques for the "latest" hacker stoppers, using a universally whitelisted website as our middle man for a command and control, social engineering our way into some of the toughest companies, and showing off some techniques that work for us. This talk is about throwing misconceptions of protection and safety out the window, and going back the dirty south.
Vulnerability Analysis
Where thinking outside of the box is a requirement. We'll be releasing two new tools, one that makes meterpreter invisible over the network, and the other a shell that uses a popular third party as the command and control. A vulnerability scanner won't help you herrrrrrre. David Kennedy (@dave_rel1k) is founder and principal security consultant of TrustedSec - An information security consulting firm located in Cleveland Ohio. David was the former Chief Security Officer (CSO) for a Fortune 1000 where he ran the entire information security program.
Exploitation and Demonstrations
Kennedy is a co-author of the book "Metasploit: The Penetration Testers Guide," the creator of the Social-Engineer Toolkit (SET), and Artillery. Kennedy has presented on a number of occasions at Black Hat, Defcon, ShmooCon, BSIDES, Infosec World, Notacon, AIDE, ISACA, ISSA, Infragard, Infosec Summit, and a number of other security-related conferences. Kennedy has been interviewed by several news organizations including CNN, Fox News, and BBC World News. Kennedy is on the Back|Track and Exploit-DB development team and co-host of the Social-Engineer.org podcast. Kennedy is one of the co-authors of the Penetration Testing Execution Standard (PTES); a framework designed to fix the penetration testing industry.
Remediation and Defensive Strategies
Kennedy is the co-founder of DerbyCon, a large-scale conference in Louisville Kentucky. Prior to Diebold, Kennedy was a VP of Consulting and Partner of a mid-size information security consulting company running the security consulting practice. Prior to the private sector, Kennedy worked for the United States Marine Corps and deployed to Iraq twice for intelligence related missions. Nick Hitchcock (@nick8ch) is a Senior Security Consultant at TrustedSec and has a relentless pursuit to break security and make things do things they were not meant to do. He also has experience working in the IT/information security field for several years and has performed large scale security assessments/penetration tests, risk assessments, forensic analysis, physical security assessments, social engineering engagements. In addition to secular work Nick is also actively involved in the Infosec community, being one of the organizers of DerbyCon and head of security for BSidesLV and BSidesDE. He also is a contributor to social-engineer.org and part of the Social Engineering CTF team at DEF CON. OSCP, GPEN
Related talks
Main Stage·52 min
Mudge
Mudge explores unexpected stories from a hacker inside the government at DEF CON 21, examining tor-network and practical defenses.
Main Stage·44 min
Eric Fulton · Daniel Zolnikov
Eric Fulton and Daniel Zolnikov explores the politics of privacy and technology at DEF CON 21, examining tor-network and practical defenses.
Main Stage·1 hr 48 min
Kurt Opsahl · Marcia Hoffmann · Dan Auerbach · Eva Galperin · Marc Jaycox · Mitch Stoltz
Kurt Opsahl and Marcia Hoffmann explores ask the eff: the year in digital civil liberties at DEF CON 21, examining tor-network and practical defenses.