Offensive Defense

Presented at ToorCon San Diego 14 (2012), Oct. 21, 2012, 4:30 p.m. (20 minutes)

Cyber-criminals have had back-end infrastructures equivalent to Virus Total to test if malware and exploits are effective against AV scanners for many years, thus showing that attackers are proactively avoiding detection when building malware. In this day of age malicious binaries are generated on demand by server-side kits when a victim visits a malicious web page, making reliance solely on hash based solutions inadequate. In the last 15 years detection techniques have evolved in an attempt to keep up with attack trends. In the last few years security companies have looked for supplemental solutions such as the use of machine learning to detect and mitigate attacks against cyber criminals. Let's not pretend attackers can't bypass each and every detection technique currently deployed. Join me as I present and review current detection methods found in most host and network security solutions found today. We will re-review the defense in depth strategy while keeping in mind that a solid security strategy consists of forcing an attacker to spend as much time and effort while needing to know a variety of skills and technologies in order to successfully pull off the attack. In the end I hope to convince you that thinking defensively requires thinking offensively.


Presenters:

  • Stephan Chenette
    Stephan Chenette is the Director of Research and Development at IOActive, where he conducts ongoing research to support internal and external security initiatives within the IOActive research team. Stephan has been involved with security research for the last 10 years and has presented at numerous conferences including BlackHat, CanSecWest, RSA, RECon, AusCERT, ToorCon, SecTor, SOURCE, and PacSec. His specialty is in writing research tools and investigating emerging next-generation threats, about which he has released public analyses on various vulnerabilities and malware. Prior to joining IOActive, Stephan was the head security researcher at Websense for six years and a security software engineer for four years, working in research and product development at eEye Digital Security.

Similar Presentations: