The FIRST Technical Colloquium (TC) event is restricted to FIRST members only and will be held in Oct 13-18, 2007.
Nevertheless, since this will be a joint event with other CSIRT initiatives in the region, there will be additional events adjacent to the TC in order to achieve non-FIRST-members as well.The event is the Security Workshop.
CSIRT Training Course
CSIRT Training Course
Security workshop / 3rd COLARIS
Security workshop / 3rd COLARIS
FIRST TC Plennary sessions
FIRST TC Hands On classes
CSIRT Training Course | |
---|---|
08:30 – 09:30 | Introduction |
09:00 – 10:40 | Module 1: Organizational Issues |
10:40 – 11:00 | Coffee break |
11:00 – 12:30 | Module 1: Organizational Issues |
14:00 – 15:40 | Module 2: Operational Issues |
15:40 – 16:00 | Coffee break |
16:00 – 17:00 | Module 2: Operational Issues |
17:00 – 18:00 | Module 3: Legal Issues |
CSIRT Training Course | |
---|---|
09:00 – 10:40 | Module 4: Technical Issues |
10:40 – 11:00 | Coffee break |
11:00 – 12:30 | Module 4: Technical Issues |
14:00 – 15:40 | Module 4: Technical Issues |
15:40 – 16:00 | Coffee break |
16:00 – 18:00 | Module 5: Vulnerabilities and Advisories |
Security workshop / 3rd COLARIS | |
---|---|
09:20 – 09:40 | PE BR Workshop official opening session Gonzalo Prialé (AFIN Peru, PE); Liliana Solha (FIRST.Org, BR) |
09:40 – 10:40 | US Keynote Speaker: The good guys fight back: The APWG phishing and E-crimeUpdate Patrick Cain (Anti-Phishing Working Group, US) |
10:40 – 11:00 | Coffee break |
11:00 – 11:40 | BR Security in development of new technologies Renato Campos (HUAWEI, BR) |
11:40 – 12:20 | US Arsene Laurent (Telefonica USA Inc., US) |
12:20 – 13:00 | ES SPAM: White list vs black list Francisco Monserrat (FIRST.org, ES) |
13:00 – 14:30 | Lunch Sponsored by Telefonica |
14:30 – 16:30 | GB Keynote Speaker: A day in the life of a hacker Adam Laurie (RFIDIOt, GB) |
16:30 – 16:50 | Coffee break |
16:50 – 18:00 | US GB ES BR Panel Session: A security incident seen from different perspectives *James N. Duncan - Moderator (BB&T Corporation, US); Adam Laurie (RFIDIOt, GB); Arsene Laurent (Telefonica USA Inc., US); Francisco Monserrat (FIRST.org, ES); Omar Kaminski (CAIS/RNP, BR); Patrick Cain (Anti-Phishing Working Group, US) |
Security workshop / 3rd COLARIS | |
---|---|
09:00 – 09:20 | Open coffee |
09:20 – 09:40 | PE Opening remarks José Revilla, Juan José García (Telefónica Perú, PE) |
09:40 – 10:40 | US Keynote speaker: Bot & botnet taxonomy Jose Nazario (Arbor Networks, US) |
10:40 – 11:00 | Coffee break |
11:00 – 11:40 | BR Ronaldo Castro de Vasconcellos (CAIS/RNP, BR) |
11:40 – 12:20 | US FIRST: Initiatives and international cooperation Kenneth R. van Wyk (FIRST.Org, US) |
12:20 – 13:00 | ES Security management in the carriers Leonardo Amor (Telefónica España, ES) |
13:00 – 14:30 | Lunch Sponsored by Telefonica |
14:30 – 15:20 | US Keynote Speaker: From the SANS Internet Storm Center: future trends in network security Tom Liston (SANS Internet Storm Center, US) |
15:20 – 15:50 | BR Legal Aspects of Security Incidents in Latin America Omar Kaminski (CAIS/RNP, BR) |
15:50 – 16:30 | US Cyber fraud trends and mitigation Ralph Thomas (VERISIGN iDefense, US) |
16:30 – 16:50 | Coffee break |
16:50 – 17:30 | US What we learn from cyber exercises, or not! James N. Duncan (BB&T Corporation, US) |
17:30 – 17:45 | PE Workshop official closing session Javier Manzanares (Telefónica Perú, PE) |
17:45 – 18:30 | sponsored by Telefonica |
FIRST TC Plennary sessions | |
---|---|
08:30 – 09:00 | Registration |
09:00 – 09:20 | Open FIRST TC day chair |
09:20 – 09:50 | JP DNS passive monitoring and analysis Yoshinobu Matsuzaki (Telecom-ISAC Japan, JP) |
09:50 – 10:20 | US If Kubler-Ross were handling vulnerabilities James N. Duncan (BB&T Corporation, US) |
10:20 – 10:40 | Coffee-break |
11:20 – 12:00 | US Common toolkits: Banking trojans and exploitation frameworks Michael La Pilla (VeriSign – iDefense, US) |
12:00 – 13:00 | US Virtually Secure - Detection and Escape from Virtual Machines Tom Liston (SANS Internet Storm Center, US) |
13:00 – 14:30 | Lunch |
14:30 – 15:00 | ES US BR Francisco Monserrat (FIRST.org, ES); Kenneth R. van Wyk (FIRST.Org, US); Liliana Solha (FIRST.Org, BR) |
15:00 – 16:30 | Work in progress session Various FIRST Members |
16:30 – 16:50 | Coffee-break |
16:50 – 17:30 | BR Malware distribution trough software piracy: a case study Jacomo Piccolini (ESR/RNP, BR) |
17:30 – 17:40 | Closing remarks |
FIRST TC Hands On classes | |
---|---|
09:00 – 10:30 | US Common Vulnerabilities Score System (CVSS) training Gavin Reid (HUMAN Security, US) US Understanding & analyzing botnets Jose Nazario (Arbor Networks, US) US Writing good security advisories: A Hands-On guide to delivering bad news in the best possible way James N. Duncan (BB&T Corporation, US) |
10:30 – 10:50 | Coffee break |
10:50 – 12:00 | US Common Vulnerabilities Score System (CVSS) training Gavin Reid (HUMAN Security, US) US Understanding & analyzing botnets Jose Nazario (Arbor Networks, US) US Writing good security advisories: A Hands-On guide to delivering bad news in the best possible way James N. Duncan (BB&T Corporation, US) |
12:00 – 13:30 | Lunch |
13:30 – 15:30 | NL Kees Trippelvitz, Wim Biemolt (SURFnet, NL) US Understanding & analyzing botnets Jose Nazario (Arbor Networks, US) |
15:30 – 15:50 | Coffee break |
15:50 – 17:00 | NL Kees Trippelvitz, Wim Biemolt (SURFnet, NL) US Understanding & analyzing botnets Jose Nazario (Arbor Networks, US) |
Michael La Pilla (iDefense, US)
Attackers use toolkits to generate a large percentage of the
malicious code companies face. By analyzing and understanding these tools
we can develop strategies to quickly identify and mitigate the threats
they pose.
Again I'd like to thank you for allowing me to speak at the FIRST TC. It
was a great honor to meet so many new contacts from Latin America who I
probably would not have had the opportunity to meet without this
conference.
October 17, 2007 11:20-12:00
Gavin ReidGavin Reid (HUMAN Security, US)
This class will first go over CVSS basics. Then have the participants score some test vulnerabilities and go over results. We will also cover the new version of CVSS and upcoming changes.
Students use their own laptops to run a .xls file to score vulnerabilities.
October 18, 2007 09:00-10:30, October 18, 2007 10:50-12:00
Arsene Laurent (Telefonica USA Inc., US)
Born and raised in Caracas, Venezuela, Mr. Arsene Laurent's present role is full responsibility of Telefonica USA's Information Security Operations.
Before moving to the United States in 2001, he was the Director of Operations at Terra Networks, Venezuela. Between 2001 and 2003, he worked as the senior UNIX Engineer of Terra Networks USA. In this position, he participated in forensic analysis activities and responded to DDoS attacks which included investigations that led to the identification of possible attackers using social engineering techniques within the Internet Relay Chat
(IRC) while collaborating with the FBI.
Mr. Laurent was also the Operations Manager at Terra Networks USA where he was responsible for the design, architecture, building and ongoing operations of the technological platform for several web sites including terra.com, lycos.com, tripod.com among others.
Previous to his involvement in Information Security and Forensics, he managed UNIX systems for British Petroleum (BP) Venezuela. Mr. Laurent holds a degree in Computer Science from “Universidad Central de Venezuela”
(Central University of Venezuela), and he is a Certified Information Systems Security Professional (CISSP).
Mr. Laurent served in several organizations as a volunteer and was a member of the steering committee for the ACM International Collegiate Programming Contest (ACM-ICPC). He also co-founded of the Venezuelan chapter for the International Olympiad in Informatics (IOI), which launched in 1998.
Mr. Laurent's interests are Systems Automation, Telecommunications and he is a hobbyist of Voice over IP (VoIP) technologies. His future academic goal is to pursue a degree in Criminology with a focus on Forensic Science Investigation in Computer Crime.
October 15, 2007 11:40-12:20
Ralph Thomas (VERISIGN iDefense, US)
Phishing Trojan horse programs are not traditional bots, but sophisticated and
original pieces of malicious code. Since iDefense began tracking this technique
in May 2006, attackers have quietly seeded dozens of variants into the wild to
target at least 30 specific banking institutions. These attackers had intimate
knowledge of each targeted bank’s Web infrastructure and built a sophisticated
command-and-control system that completely automated the attacks. The authors
believe that criminal organizations are using these phishing Trojans to
compromise millions of bank accounts across the globe. These Phishing Trojan
attacks can defeat sophisticated authentication schemes that security experts
previously thought rock solid.
This presentation discusses mitigation techniques that work and fail in light
of these new malicious code attacks. The audience will be given an overview on
malicious code attacks against the financial infrastructure and an introduction
to banking authentication schemes. The presentation also includes cyber fraud
detection and mitigation strategies.
Mr. Thomas heads the iDefense Malicious Code Operations Group, responsible for
the active collection of open-source intelligence, and for the reporting and
analysis of public reports and outbreaks of malicious code. Mr. Thomas also
directs the malicious code research lab in iDefense, which is tasked with the
development of tools for discovery and analysis of malicious code and related
threats. Before joining iDefense, Mr. Thomas worked as Principal Computer
Forensics Consultant in several data acquisition and litigation support
projects and served as expert witness in federal court. Early in his career Mr.
Thomas designed hardware and realtime software in the controls and digital
television sectors before turning his attention to enterprise software. A
Certified Lotus Specialist, he has expertise in e-mail archiving, document
imaging, Siebel, SAP and Oracle Applications. Mr. Thomas holds a Master of
Science degree in Electrical Engineering from the University of Dortmund in
Germany.
October 16, 2007 15:50-16:30
Yoshinobu Matsuzaki (Telecom-ISAC Japan, JP)
IIJ was gathering data from its caching dns servers during the recent attack to root dns servers in this February. I will describe the analysis method and the attack effect based on this data. There were response delays and packet losses between our caching servers and root/tld servers during the attack, but it seems the effect for end-users is minimum or ignorable.
October 17, 2007 09:20-09:50
Kenneth R. van WykKenneth R. van Wyk (FIRST.Org, US)
As attackers have changed their technologies and tactics over the years,incident responders have adapted out of necessity. One thing has remained constant: the human factor. Even with all of today's automated intrusion detection, rapid communications, etc., nothing helps incident responders as much as knowing who the person at the other end of the phone or email is.FIRST is an international organization that helps foster those interpersonal relationships and human networks. This talk with present an introduction to FIRST and what it is doing to help incident responders around the world deal with today's information security problems.
October 16, 2007 11:40-12:20
Kenneth R. van WykFrancisco Monserrat (FIRST.org, ES), Kenneth R. van Wyk (FIRST.Org, US), Liliana Solha (FIRST.Org, BR)
FIRST SC members will provide a "FIRST Status Update" to let the attendees know what things FIRST is currently working on as well as what's been done in the last few months. They will also describe various initiatives that are taking place within FIRST and what things are coming up in the near future.
October 17, 2007 14:30-15:00
James N. Duncan (BB&T Corporation, US)
In her groundbreaking work, On Death and Dying, and her Ph.D. research preceding the book's publication, Dr. Elisabeth Kubler-Ross developed "The Five Stages of Grief" to describe the five unique stages experienced by a person facing a terminal diagnosis. For dealing with imminent death alone, this seminal work transformed grief counseling in health care and allied disciplines. It has broader applicability to many other similar situations, basically any event in which traumatic outcomes are presented. The speaker will apply the Five Stages to product security incidents with explanations and examples based on real events. The suggestions can be easily expanded to any other type of cyber security event or response to a disaster. Attendees will leave the session with one more tool in the CSIRT toolbox for handling incidents more quickly and effectively.
October 17, 2007 09:50-10:20
Adam Laurie (RFIDIOt, GB)
In this session I will give a roundup of some the issues I've spoken about over the last year, which include: Mag stripes,Infra Red, RF ID, ATM Machines. Whilst I aim to make this reasonably technical, it will be fairly relaxed and informal, with live demonstrations and some room for experimentation if any of the participants are brave enough...
October 15, 2007 14:30-16:30
Jose Nazario (Arbor Networks, US)
A technical overview of the various malicious bot families and how they work, including source code, disassembly analysis and how they attack new systems. Attendees will leave with a thorough understanding of common bot internals, ability to spot them and stop them. Programming and TCP/IP knowledge not required but helpful.
October 16, 2007 09:40-10:40
Tom Liston (SANS Internet Storm Center, US)
The SANS Internet Storm Center receives millions of lines of firewall and IDS logs from hundreds of thousands of hosts every month. Given this huge influx of data, the ISC sits in an excellent position to see cutting edge attacks. In addition, the SANS ISC is staffed by approximately 35 volunteer handlers who together have an amazing insight into security trends. Come and hear about what the ISC
Handlers see when they gaze into their crystal ball.
October 16, 2007 14:30-15:20
Patrick Cain (Anti-Phishing Working Group, US)
This presentation will discuss the current state of electronic fraud and describe recent initiatives in the APWG to reduce the amount of phishing, fraud, and e-crime on the Internet.
These initiatives include working with ICANN to fortify the DNS system against use by phishing, a federated contact system for responders, and improvements to the APWG data collection system that includes malware, bot, and other crimeware data.
The latter part of the presentation will describe how to tell if you are being phished, identify proper response activities, and suggest best practices to reduce your exposure to phishing and fraud.
October 15, 2007 09:40-10:40
Omar Kaminski (CAIS/RNP, BR)
Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.
October 16, 2007 15:20-15:50
Jacomo Piccolini (ESR/RNP, BR)
Trust no one or you will be assimilated! This is the current scenario
inside the software cracking and piracy community. This paper focuses on
the study of the usage of pirate software to infect systems and their
abuse by miscreants. Statistics from collected malware related to software
piracy will be presented.
The author believes software piracy will always exist, here included
operational systems, applications and games. The problem is directly
related to the customer’s compulsory behavior for new features and
releases leading the user to consume any product; even in beta version
(sometimes faked versions) and piracy products.
To deal with this demand, some specialized piracy groups had, for long
time, supplied this market with diverse products, among others, we
emphasize keygens, which are applications that can generate a registration
key to allow software installation and cracks, which are modifications in
files from the target software that allows their execution or removes
existing protections.
With the advance of software protection techniques, new forms to
circumvent these protections and to make this content available are being
offered, such as installation packages, cracked versions ready to run and
CD emulators. The piracy community is always developing new ways to take
care of the demand and to circumvent the protections that are implemented.
The universe of software piracy possess multiple mechanisms of
distribution: sites specialized in cracks, keygens and emulators
(cd-roms), ftp servers, CDs being sold in streets or offered in sites and
mainly P2P applications.
The process of malware distribution uses any of these mechanisms, with
only small differences. We must understand that miscreants are very
creative and their main goal is to infect as many systems as possible.
Files that are accessible through web pages are hosted in sites that
explore vulnerabilities in navigators. Why wait for user to download and
execute if the system can be infected and controlled through browser
vulnerabilities?
Even the malware files, available as keygens and cracks, possess different
forms of infection; the great majority of analyzed specimens will infect a
system in a second stage, after the installation and decompression. This
technique is used only to make more difficult the file identification as
malware. The main functionality of this type of malware also varies from
simple downloaders and adware to botnets. From the miscreant’s point of
view this is the perfect scenario, the end user is downloading and
executing malicious code with their consent and without any restrictions.
In 2006 one of the main sources of malware propagation through software
piracy was the creation of dozens of crackers for the Windows Genuine
Advantage. The constant updates of the WGA tool had made users of
counterfeit versions of Windows to often search for new versions of
crackers and, when they did not succeed, they simply started to install
all available crackers. From the WGA cracking files collected, almost 70%
were classified as downloaders and bots with elevated degree of
sophistication and difficult removal process.
The same issue occurred in the end of the 2006 with the launching of the
new version of the Internet Explorer, whose installation only successes
through the authentication of the operational system as being legit.
This kind of exploitation and propagation is not restricted to Microsoft
products; any popular software with some installation restriction is being
used as an attack vector.
The consumer of piracy software is at this moment being heavily targeted
by the piracy community which only aims to infect and to control their
system for illicit purposes and to feed the piracy industry, normally by
stealing all serial numbers of installed software from the users system
and later distribution on web sites, without forgetting the traditional
use of the systems as part of botnets.
The message here is simples, there is no crack or keygen or another tool
related to software piracy that can be considered safe to use, even to
download. Users must be discouraged to consume any kind of software piracy
in order to avoid their personal information and systems being used my
miscreants.
October 17, 2007 16:50-17:30
*James N. Duncan - Moderator (BB&T Corporation, US), Adam Laurie (RFIDIOt, GB), Arsene Laurent (Telefonica USA Inc., US), Francisco Monserrat (FIRST.org, ES), Omar Kaminski (CAIS/RNP, BR), Patrick Cain (Anti-Phishing Working Group, US)
James N. Duncan, CISSP, is the Cyber Security Incident Response Team Coordinator for BB&T Corporation, currently the 11th largest domestic financial holding company in the United States. His constituency extends over 34 subsidiaries and nearly 30,000 employees in eleven states providing nearly every imaginable financial service from traditional banking, wealth management, and investments, to insurance, payroll management, software development, and ASPs for other financial services companies. The bank's web presence, bbt.com, has received numerous awards for excellence in on-line banking.
Previously, Jim Duncan worked at Cisco Systems where he provided incident response team support within the Critical Infrastructure Assurance Group, acting as technical liaison for various ISACs and government agencies (US and others), and was the team lead for the Cisco Product Security Incident Response Team, handling vulnerabilities in Cisco products from initial report to final composition and publication of a security advisory. Prior to that, he was employed as network engineer and principal systems administrator in various departments at the Pennsylvania State University.
In between, Mr. Duncan developed one of the first tutorials focusing on developing incident response teams way back in 1996 (with Rik Farrow for the USENIX Association), served a two-year term on the Steering Committee/Board of Directors of the Forum of Incident Response and Security Teams, and became an approved TRANSITS instructor, teaching several TRANSITS classes around the globe.
Jim is also a soccer referee, certified by the United States Soccer Federation, US Indoor Soccer, and the North Carolina High School Athletic Association, and has officiated many hundreds of matches in the last four years.
He is in wide demand on multiple continents as a speaker and instructor (and referee).
He is in wide demand on multiple continents as a speaker and instructor (and referee).He is in wide demand on multiple continents as a speaker and instructor (and referee).Adam Laurie is a Director of The Bunker Secure Hosting Ltd. He started in the computer industry in the late Seventies, working as a computer programmer on PDP8 and other mini computers, and then on various Unix, Dos and CP/M based micro computers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention to those areas and away from programming, starting a data conversion company which rapidly grew to become Europe's largest specialist in that field (A.L. downloading Services). During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own -ApacheSSL - which went on to become the defacto standard secure web server. Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of reusing military data centres (housed in underground nuclear bunkers) as secure hosting facilities. Adam has been a senior member of staff at DEFCON (http://www.defcon.org) since 1997, and also acted as a member of staff during the early years of the Black Hat Briefings, where he is now a regular training instructor (http://www.blackhat.com), and he is also a member of the Bluetooth SIG Security Experts Group (http://www.bluetooth.org). His current focus is on RFID, and he has recently published an opensource RFID software library, written in Python, which can be found at http://rfidiot.org.
He is in wide demand on multiple continents as a speaker and instructor (and referee).Adam Laurie is a Director of The Bunker Secure Hosting Ltd. He started in the computer industry in the late Seventies, working as a computer programmer on PDP8 and other mini computers, and then on various Unix, Dos and CP/M based micro computers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention to those areas and away from programming, starting a data conversion company which rapidly grew to become Europe's largest specialist in that field (A.L. downloading Services). During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own -ApacheSSL - which went on to become the defacto standard secure web server. Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of reusing military data centres (housed in underground nuclear bunkers) as secure hosting facilities. Adam has been a senior member of staff at DEFCON (http://www.defcon.org) since 1997, and also acted as a member of staff during the early years of the Black Hat Briefings, where he is now a regular training instructor (http://www.blackhat.com), and he is also a member of the Bluetooth SIG Security Experts Group (http://www.bluetooth.org). His current focus is on RFID, and he has recently published an opensource RFID software library, written in Python, which can be found at http://rfidiot.org.He is in wide demand on multiple continents as a speaker and instructor (and referee).Adam Laurie is a Director of The Bunker Secure Hosting Ltd. He started in the computer industry in the late Seventies, working as a computer programmer on PDP8 and other mini computers, and then on various Unix, Dos and CP/M based micro computers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention to those areas and away from programming, starting a data conversion company which rapidly grew to become Europe's largest specialist in that field (A.L. downloading Services). During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own -ApacheSSL - which went on to become the defacto standard secure web server. Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of reusing military data centres (housed in underground nuclear bunkers) as secure hosting facilities. Adam has been a senior member of staff at DEFCON (http://www.defcon.org) since 1997, and also acted as a member of staff during the early years of the Black Hat Briefings, where he is now a regular training instructor (http://www.blackhat.com), and he is also a member of the Bluetooth SIG Security Experts Group (http://www.bluetooth.org). His current focus is on RFID, and he has recently published an opensource RFID software library, written in Python, which can be found at http://rfidiot.org.Born and raised in Caracas, Venezuela, Mr. Arsene Laurent's present role is full responsibility of Telefonica USA's Information Security Operations.
He is in wide demand on multiple continents as a speaker and instructor (and referee).Adam Laurie is a Director of The Bunker Secure Hosting Ltd. He started in the computer industry in the late Seventies, working as a computer programmer on PDP8 and other mini computers, and then on various Unix, Dos and CP/M based micro computers as they emerged in the Eighties. He quickly became interested in the underlying network and data protocols, and moved his attention to those areas and away from programming, starting a data conversion company which rapidly grew to become Europe's largest specialist in that field (A.L. downloading Services). During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and, with help from his brother Ben, wrote the world's first CD ripper, 'CDGRAB'. At this point, he and Ben became interested in the newly emerging concept of 'The Internet', and were involved in various early open source projects, the most well known of which is probably their own -ApacheSSL - which went on to become the defacto standard secure web server. Since the late Nineties they have focused their attention on security, and have been the authors of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of reusing military data centres (housed in underground nuclear bunkers) as secure hosting facilities. Adam has been a senior member of staff at DEFCON (http://www.defcon.org) since 1997, and also acted as a member of staff during the early years of the Black Hat Briefings, where he is now a regular training instructor (http://www.blackhat.com), and he is also a member of the Bluetooth SIG Security Experts Group (http://www.bluetooth.org). His current focus is on RFID, and he has recently published an opensource RFID software library, written in Python, which can be found at http://rfidiot.org.Born and raised in Caracas, Venezuela, Mr. Arsene Laurent's present role is full responsibility of Telefonica USA's Information Security Operations.Before moving to the United States in 2001, he was the Director of Operations at Terra Networks, Venezuela. Between 2001 and 2003, he worked as the senior UNIX Engineer of Terra Networks USA. In this position, he participated in forensic analysis activities and responded to DDoS attacks which included investigations that led to the identification of possible attackers using social engineering techniques within the Internet Relay Chat
(IRC) while collaborating with the FBI.
Mr. Laurent was also the Operations Manager at Terra Networks USA where he was responsible for the design, architecture, building and ongoing operations of the technological platform for several web sites including terra.com, lycos.com, tripod.com among others.
Previous to his involvement in Information Security and Forensics, he managed UNIX systems for British Petroleum (BP) Venezuela. Mr. Laurent holds a degree in Computer Science from “Universidad Central de Venezuela”
(Central University of Venezuela), and he is a Certified Information Systems Security Professional (CISSP).
Mr. Laurent served in several organizations as a volunteer and was a member of the steering committee for the ACM International Collegiate Programming Contest (ACM-ICPC). He also co-founded of the Venezuelan chapter for the International Olympiad in Informatics (IOI), which launched in 1998.
Mr. Laurent's interests are Systems Automation, Telecommunications and he is a hobbyist of Voice over IP (VoIP) technologies. His future academic goal is to pursue a degree in Criminology with a focus on Forensic Science Investigation in Computer Crime.
Francisco "Paco" Monserrat is the Security Coordinator of RedIRIS (the Spanish Academic and Research Network) and he is a FIRST member since 1997. During the last few years, he has worked actively on the TF-CSIRT, iniromoting the cooperation among CSIRTs in Europe.
Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.
Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.
Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.Patrick Cain is a Research Fellow of the Anti-Phishing Working Group (APWG), and the President of The Cooper-Cain Group, Inc, a computer and Internet security consultancy. He has been associated with information security development and operations for over twenty years. He was previously the Security Advocate in the Office of the Chief Technology Officer, at Genuity Inc., a large Internet Service Provider. He is a Certified Information Systems Auditor (CISA), a Certified Information System Manager (CISM), and an associate member of the American Bar Association.
Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.Patrick Cain is a Research Fellow of the Anti-Phishing Working Group (APWG), and the President of The Cooper-Cain Group, Inc, a computer and Internet security consultancy. He has been associated with information security development and operations for over twenty years. He was previously the Security Advocate in the Office of the Chief Technology Officer, at Genuity Inc., a large Internet Service Provider. He is a Certified Information Systems Auditor (CISA), a Certified Information System Manager (CISM), and an associate member of the American Bar Association.Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.Consultant of CAIS/RNP, Director of Internet of the Brazilian Institute of Politics and Cyberlaw (IBDI), suplent member of the Brazilian Internet Steering Comittee (CGI.br) representing the scientific and technological community, Associate of Kaminski, Cerdeira, Pesserl Attourneys At Law.Patrick Cain is a Research Fellow of the Anti-Phishing Working Group (APWG), and the President of The Cooper-Cain Group, Inc, a computer and Internet security consultancy. He has been associated with information security development and operations for over twenty years. He was previously the Security Advocate in the Office of the Chief Technology Officer, at Genuity Inc., a large Internet Service Provider. He is a Certified Information Systems Auditor (CISA), a Certified Information System Manager (CISM), and an associate member of the American Bar Association.Mr. Cain participated in the FSTC Counter-Phishing project, is a research member of the Anti-Phishing Working Group, and currently leads the effort in the IETF to standardize phishing and electronic crime reports. He is the co-chair of the IETF Operations Security Working Group and has participated in a US White House working group identifying and addressing the vulnerabilities of the Internet.
October 15, 2007 16:50-18:00
- ES
SPAM: White list vs black list
Francisco Monserrat (FIRST.org, ES)
Francisco "Paco" Monserrat is the Security Coordinator of RedIRIS (the Spanish Academic and Research Network) and he is a FIRST member since 1997. During the last few years, he has worked actively on the TF-CSIRT, iniromoting the cooperation among CSIRTs in Europe.
Paco has spoken on various conferences and his activities focus on Forense Analysis, criptography and Computer Security Incidents Response Teams.
October 15, 2007 12:20-13:00
- NL
SURFids overview
Kees Trippelvitz (SURFnet, NL), Wim Biemolt (SURFnet, NL)
To provide the institutions connected to SURFnet a better insight in malicious traffic SURFnet developed the SURFids service. An easy to deploy and manage distributed Intrusion Detection System (IDS). During this demo/tutorial some subjects that will be addressed are the kind of (automatic) reports this service can generate, multiple VLAN support and the sandbox analysis. Also the latest features of SURFids will be shown, such as Layer-2 detection (ARP spoofing/poisoning) and argos.
Format
It will be mainly a live demonstration. Participants can turn their laptop in a IDS sensor if it is capable of booting from usb stick. To fully participate students are advised to install vmware (http://www.vmware.com). Images will be provided during class.
October 18, 2007 13:30-15:30, October 18, 2007 15:50-17:00
- US
Understanding & analyzing botnets
Jose Nazario (Arbor Networks, US)
This full-day workshop is designed to provide attendees with a thorough understanding of botnets: what they are, how they're created, how to identify them, and how to stop them. The workshop will consist of both presentations and hands-on sessions where attendees can interact with the instructors for further support. The notion of "rapid response" is taken into consideration with each aspect of the workshop, focusing on techniques and methodologies that can be applied in timely manner. At the completion of this workshop, attendees will walk away with applicable real world knowledge that can be applied in their daily work.
The goals of this training session are for the attendees to more fully understand botnets, build tools to identify their presence in the wild and build intelligence as to their presence on their own networks, and how to defend against their attacks. Attendees are expected to be technically savvy and in network or security operations. Laptops will be required for the hands on portions of the training.
Format
Hands-on class. Students use their own laptops with a vmware image provided by the instructor.
October 18, 2007 09:00-10:30, October 18, 2007 10:50-12:00, October 18, 2007 13:30-15:30, October 18, 2007 15:50-17:00
- US
Virtually Secure - Detection and Escape from Virtual Machines
Tom Liston (SANS Internet Storm Center, US)
Virtualization tools like VMware, Microsoft Virtual Server, and the Linux KVM represent some of the fastest growing segments in IT.
Many of these technologies are deployed in ways that assume that they provide a high degree of isolation between host and guest. Over the past two years, Intelguardians has been researching the degree of isolation that various virtual machine environments (VMEs) provide and poking at the boundaries between host and guest. This session will present our findings and provide concrete guidelines for deploying virtualization as securely as possible.
October 17, 2007 12:00-13:00
- US
What we learn from cyber exercises, or not!
James N. Duncan (BB&T Corporation, US)
Nearly everyone will agree that cyber exercises are valuable, but regardless of the planning, effort, and resources committed to them, most exercises produce the same results, including the same errors, and real-life events demonstrate that we still aren't getting the process of exercises quite right. Based on his experiences with multiple cyber exercises (large and small), his involvement in critical infrastructure protection working groups, and his experience with incident response and handling corporate reactions to disasters such as Hurricane Katrina and the London Underground Bombings, the presenter will enumerate notable successes of cyber exercises, describe areas for improvement, and provide items for the attendee to consider when evaluating his or her own exercise planning, execution, and results.
October 16, 2007 16:50-17:30
- BR
Wireless Auditor's Toolbox
Ronaldo Castro de Vasconcellos (BR)
Those who need to perform an audit and does not keep themselves up to date
with the latest tools, hardware, news and trends may have a bad time when
it comes to wireless.
This session will present you a proposal of wireless software and hardware
toolbox for wireless auditing with focus on low cost hardware and free
software tools - the most functionality with the least hardware possible,
a "poor man's wireless auditor kit".October 16, 2007 11:00-11:40
- PE BR
Workshop official opening session
Gonzalo Prialé (AFIN Peru, PE), Liliana Solha (FIRST.Org, BR)
Liliana Solha holds a Bachelor degree in Industrial Engineering at University of Lima (Ulima), Peru, and a Post Graduation title in Computer Networks at the University of Campinas (UNICAMP), Brazil. She has been involved in security area since 1996. In 1998 was nominated as CAIS/RNP Manager, the Brazilian Academic and Research Network CSIRT. She leaded the FIRST affiliation process of CAIS/RNP in 2001, sponsoring later the affiliation of other three Latin American CSIRTs.
In the last few years she impelled the development of CSIRTs in Latin America, promoting the establishment of a regional initiative. She acts as a FIRST Steering Committe Member since 2002 - the first Latin American representative on this board. She actively participated on the establishment of "CLARA - Cooperation of Latin America Research and Academic - Security Task Force (GT-Seg)" in May 2005, acting as the Co-Chair since then. This initiative basically promotes the security awareness and development of CSIRTs in National Research and Education Networks of Latin America and Caribbean.
Liliana has participated as a speaker and trainer at several Brazilian and international security events.
October 15, 2007 09:20-09:40
- US
Writing good security advisories: A Hands-On guide to delivering bad news in the best possible way
James N. Duncan (BB&T Corporation, US)
Once a rare occurrence a decade ago, security advisories are now produced many times a day. For each one, there are multiple other companion advisories or commentaries produced in response, and each of those have slightly different information from different sources, are produced or collected at different times, and are written in different styles with different ultimate goals.
Is it any wonder that we are confused? And we are the experts!
The existing state of the art is complex and so are the products, but the goal of this hands-on class is simple: Find the common elements of advisory construction that are _good_, eliminate the _bad_, and develop a framework for producing better future advisories.
Format
The class will be consensus-led. The instructor will provide background and examples, propose one or more vulnerabilities to study, encourage discussion, and collate material contributed by the participants. Attendees are expected to contribute to discussion and commentary, identify desirable and undesirable elements of advisories, compose (or help with composing) sections of text as a result of what has been learned, and then develop rules for ensuring better content in future security advisories.
Laptops are recommended highly but are not required; pen and paper will be adequate. Attendees will compose some sections separately at the same time to compare with others, and at other times attendees will work in parallel on different sections of an advisory to be collated by the instructor. Experience with more than one language will be valuable but is not required.
October 18, 2007 09:00-10:30, October 18, 2007 10:50-12:00