Presented at
DEF CON 14 (2006),
Aug. 6, 2006, noon
(50 minutes).
We all want to be awesome hackers, but let's face it: inventing the sploitz can be hard work. What if there were a way to make interesting security discoveries using relatively simple tools, recycled concepts from research in other fields, and readily available data? For better or worse, this is the kind of question that we at foofus.net ask ourselves on a regular basis. And it's in that spirit that we present this fine talk.
We'll show some incremental advances in our penetration testing tools (once again, focused on identifying and taking advantage of trust relationships between Windows systems), and we'll appropriate concepts from graph theory. Our main goals are twofold. First, we want to find ways of mining new conclusions out of the same old data that's been staring us in the face all along. Second, we want to find ways of making the data we collect more interesting and useful. Basically, we're trying to look cool without having to work too hard.
Previously, we've provided tools for gathering this sort of information, and for representing it mathematically and visually. This year's talk focuses on using these techniques to draw worthwhile conclusions and offer helpful advice. As usual, our tools will be provided (such as they are), and a good time will be had by all.
Presenters:
-
Foofus
Foofus leads a team of security engineers at a technology consulting firm in the midwest, where he has worked for the past nine years. He has spoken at a variety of events and conferences including Defcon, ToorCon and LISA. His chief technical interests are software security, and the security relationships that emerge between systems in large networked environments. In his spare time Foofus enjoys playing guitar, cooking, and attending the opera and symphony.
Links:
Similar Presentations: