Behind the Firewall – episode 013: CanSecWest 2011

CanSecWest is in it’s 12th year now.  It started with the small, highly technical computer security conference in Vancouver and has since expanded to include a PacSec in Asia and EUSecWest in Europe, a 3 day dojo of training preceeding the conference, and for the last 4 years an event which has eclipsed the con itself – pwn2own.

This year the talks were mostly focused on applications and bug hunting as might be expected along side the pwn2own competition.  As for pwn2own itself, some prizes were won and some not.  Charlie Miller took away an iPhone 4 this year via a mobile Safari exploit.  Stephen Fewer won a laptop by combining three different exploits to pwn IE8 on Windows 7-SP1.  The VUPEN team walked off with an iBook for popping OS X through Safari.  And Vincenzo Iozzo from Zynamics won big with the RIM’s BlackBerry Torch 9800.  Of course there ARE some odd rules and one of the favorites to take out some of the prizes left “standing” didn’t show.  It’s a jungle out there for Apple users but that shouldn’t leave Android, Chrome or Windows Phone 7 feeling invulnerable.  YOUR bugs will live a little longer.

HNN was there in Vancouver, BC for the action.  We hope you enjoy the sights and sounds of CanSecWest, 2011.

HNNCast.2010.10.01

HNNCast for the first week of October, 2010

Top Stories
Baaaaad Twitter, Zeus Gets Linked In, Orkut Under Attack, Cyber Storm III, Still Stuck on Stuxnet Drive, Payback is Still a Bitch, Anonymous v. AFACT, Zeus Busts, Zeus’ Achilles Heel

News
Pena to da Pokey, the Online Banking Show, SIM Scam Shutdown, CSAW Swings Back Around, GovNet Groans from the Grave

Tool Time
WakeOnLan, WiFiTE, Samurai WTF, CERT BFF, Pass The Hash Toolkit, MANDOS

Quickies
My Opera a Tragedy, HDCP Key fo Sheezey, to Catch da Koobface Gang, Kryogeniks used in a Sentence, Rubico’s Kernel of Hope, ebay Attacker Outed, Kayne’s Bad Friday, Chavez does the Twitterbug

Con-Fu
Cyber Patriot, CCC Pre-sales and CFP, Thotcon Pre-sales and CFP, Autum Lectures at Bletchly Park, Hack3rcon Pre-sales

Stack of Shame
count: 140 (-2)
days til day zero: 126
up for release on day zero: 130 (-8)
birthdays: none

HNNCast.2010.08.20

HNNCast for the third week of August 2010 -
Top Stories:
Free Malware from Network Solutions, Virgin’s Love Letter to the Bot Herd, V(D)-Cards, Facebook Likes Malware, iPhone Suck and Sell Scam

News:
Defacement Buffet, OhyouwantAUTH? Celebrity Twits, Month of Abyssec Bugs, Underworld Transaction Processor Popped, Facebook Hack 1.0

Tool Time:
RIPS, RS Mangler, ROPME, Halbred, SAMHAIN, nfex, URLVoid, MBSA 2.0 (NOT), nmapsi4

Quickies:
Cold Fusion’s Hot Mess, Facebook Leak, Passwords are Pointless, Insert Mens Room Joke Here, Smudge Attack, Shopping for SQL Injections

Con Phooey:
Hurricane Labs Hack Challenge, LockCon, Hack in the Box, Security B-Sides, ToonCON

Stack of Shame:
-count: 159
-Turning 1 Year Old This Week:

• RealNetworks: ZDI-CAN-569 & ZDI-CAN-568/RISK:HIGH (10=AV:N/AC:L/Au:N/C:C/I:C/A:C)&AV:N/AC:L/Au:N/C:C/I:C/A:C) Discovered 2009-08-20 (365 days ago) by: Anonymous
• Hewlett-Packard , IBM , Sun Microsystems: ZDI-CAN-561/RISK:HIGH (10=AV:N/AC:L/Au:N/C:C/I:C/A:C) Discovered 2009-08-20 (365 days ago) by: Rodrigo Rubira Branco (BSDaemon)
• Sun Microsystems: ZDI-CAN-552/RISK: HIGH (9.4=AV:N/AC:L/Au:N/C:C/I:C/A:N) Discovered 2009-08-20 (365 days ago) by: Sami Koivu

HNNCast.2010.08.06

HNNCast for the second week of August 2010
Top Stories
Jailbreak Me Demos Threat, Full Disclosure: Crappy Software Ahead
Courtnee: BlackHat/B-Sides/Defcon Wrap-Up

News
StuxNet Tongue-Twister, Masato Notoutforlong, Citi App Spills Secrets, Wake Up People

T00l Time
Aanval, Razorback, DFF, Passware, BinPack, BinNavi, PDF Dissector, PinTool, Seccubus, SotF, L0phtCrack

Quickies
Bulletin on vBulletin, Houston We Have a < 140 Character Problem, Carbon Trading Site Polluted, the Mets Bust Some Marlins, Ausi Malware Author Pleas, Virus Variants Spike, Inside Mumba, Moving Money from QA

Hong CON Phooey
Excaliber Con, H2H, HoaP, Thotcon 2, Shmoocon, HacKid Con, HNN in the Defcon Badge

Stack of Shame
count: 117

HNNCast 072409

HNNCast for the 4th week of July, 2009

• Adobe, DDoS, Twitter, Pwnies;
• Symbian Mobile Maleware, RIM/Etisalat, LUCID DB, DD-WRT;
• Quickies:Business Software Alliance, Virus King, FreeRainbowTables.com, DEFCON Badge Hacking, Erin Andrews maleware, Network World top-bot-nets, Metasploit training, Conf-Con, EkoParty, SourceBoston, Google Chrome anti-virus;
• Programming notes: DEFCON/HNN Stickers & We’re Back…