Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 08/01/07 web stories

The past is prologue at Black Hat Briefings

By William Jackson

LAS VEGAS — Botnets and browsers are sharing center stage at the Black Hat Briefings this week with rootkits, reverse engineering and social engineering, as the conference expands to explore more niches in information technology security. One thing you probably won’t hear much about at the conference this year is vulnerabilities in the Windows Vista operating system.

“A lot of people are working on it,” said the show’s creator, Jeff Moss. “But it’s still too early.”

Black Hat is a nuts-and-bolts conference that brings together security professionals and researchers (formerly called hackers) to explore the latest trends, developments and discoveries in cyberthreats and their defenses. It is an outgrowth of the more freewheeling DefCon convention, the 15th edition of which is being held this coming weekend at the Riviera Hotel and Casino in Las Vegas.

Some of what is being offered this year at Black Hat will be familiar territory.

“Things that we were talking about a year ago are coming to pass,” Moss said. “The exploits against browsers have gotten more sophisticated, continuing the trend of the last three years.”

Another continuing trend is the growing sophistication of command-and-control networks for botnets, the networks of compromised computers used to launch increasingly targeted attacks and to harvest profitable information for identity theft.

There are some differences in this year’s lineup, as well. One is the prevalence of work on rootkits, pieces of code that burrow deep into a system to resist detection and removal. These hidden programs can trigger unwanted activity or allow other malicious code into a system.

“We used to have one or two rootkit talks,” Moss said. “Now we could fill a whole track.”

Rootkits do not yet get a track to themselves this year, but reverse engineering does, and so does fuzzing. This year the reverse engineering track offers several presentations focusing on security issues specific to the C++ code development language, a relatively new area of study, although much application development is being done today in C++.

Fuzzing, or fuzz testing, is a software testing technique in which random data — or fuzz — is imported into a program and then watched for failures or other problems. Fuzzing has been around as a way to detect programming flaws since 1989 and is a simple and cost-effective method for evaluating software, but it is not a formal process. Research has been going on for several years to make fuzzing less random and more precise and scientific.

Moss said he was surprised by the continued work on fuzzing techniques. After four or five years of interest he believed it probably had reached the end of its life cycle, but this year he received so many submissions on it that it was given a track to itself.

More news on related topics: IT Security, IT Management



GCN Popup