• Van Hauser opened the conference with an updated version of his Pacsec/core05 presentation on IPv6 security. His talk is all the more enlighting. Definitly a must-see.
  • Then came Barnaby Jack on exploiting embedded devices (updated version of Yuji Ukai talk from Pacsec/core05), basicly taking advantage of firmware reflashing capabilities to update and reconfigure a personal router in order to propagate a worm or take any other action. His demonstration consisted in exploiting a LAN side vulnerability to inuject a modified firmware with an active payload modifying all .exe files on the fly...
  • Javier Burroni and Carlos Sarraute gave their talk on OS fingerprinting using neural networks. Excellent. Note this paper will be presented at SSTIC, one of them actually speaking french.
  • Nguyen Anh Quynh presented a Xen virtual machines based Sebek architecture named Xebek. His point is to deploy virtual machines that directly send Sebek messages through memory to Xen host, thus avoiding any network communication for spying purposes and increasing performance, flexibility and efficiency. Although all hist arguments were not that convincing, the idea of pushing a solution for live deep monitoring of hosted virtual machines directly from the host is something great.
  • Our elderly Fred "Pappy" Raynal had an impressive talk on cryptography malicious usage/abuse for better malware design, malware exploitation such as breaking into SuckIt based networks, crypto systems abuse such as SSH, etc. His ending part on Skype was particularly excellent and prefigures a kick-ass presentation from Philippe and Fabrice (take a look at his Rasta Ring 0 Debugger) at BlackHat Europe in Amsterdam.
  • Cesar Cerrudo presented local shellcode injection on Windows, using LPC named ports. Interesting technics to elevate your priviledge level on a system or attack environments such as MS Teminal Server or Citrix servers from a client.
  • Andrew Cushman, Microsoft PR/marketing/security minion, gave a very entertaining presentation, despite this fire alarm and evacuation break that had half the audience being slow to come back from the pub to see the end, on his company position towards security. I don't really have bad feelings about that talk, as one can really feel MS efforts to push security in their product. In addition to this, the content was imho more respectful of security community, modest and convincing than thoses two Oracle speeches I could attend before (see my first post on Securecon), except that all the more surprising "there's nothing worse than a patch to a patch" speaking of WMF update delay... Hummm, maybe having no patch at all for a vulnerability is worse than that, huh ? By the way, obviously, MS sponsoring the Open Bar evening party at the pub had something to do with the audience not being too tough with him ;)

To be continued...