<\/p>\n
The fifth BruCON conference was held 26th<\/sup> to 27th<\/sup> of September 2013 in Ghent, Belgium.\u00a0 From the off, the conference had a great feel, its organised by a group of security enthusiasts as a non-profit organisation and they do a great job.\u00a0 From the live classical piano playing in the lounge\/rest area where you have you \u00a0meals; breakfast, lunch and dinner (which are all included in the low price) to the large screen displaying all the recent #BruCON twitter activity it makes for an enjoyable couple of days.\u00a0 The conference was organised into a single (main auditorium) speaker track and 2 hands-on lab tracks in the afternoon.\u00a0 Whilst you\u2019re wholly free to mix and match between the main track and the lab tracks, I focused on the main speaker track (although I did hear that the labs were also excellent!), my vague recollections and highlights can be found below.<\/p>\n HTTP Time bandit – Vaagn Toukharian<\/strong><\/span><\/p>\n The tool is basically a tool to perform resource usage denial of service (DOS) type attacks against layer 7 or as referred to during the talk “HTTP GET flooding with spice”. In essence the tool performs a GET flood but some analysis is done before flooding takes place.<\/p>\n The tool first conducts a spider of the site to determine and collect the transfer times for each resource, the average speed of transfers are calculated. Once complete the resource(s) That have the slowest average transfer time(s) are calculated; effectively CPU intensive resources take longer to respond and this is what we are identifying here. To remove false positives from the returned data set statistics are used to analyse the data and discard resources that have a large degree of variance i.e. non consistent time delays that have another cause e.g. network latency.<\/p>\n The tool is available on the GitHub link:\u00a0https:\/\/github.com\/Qualys\/timeBandit <\/a><\/p>\n The speakers moved on to discuss traditional DDOS defences in the form of load balancing and commercial protection services e.g. cloud based solutions, identifying and fixing resource hogs, apache configuration options and other apache modules advanced mod_security protection<\/p>\n The speakers suggested that Timebandit can be used itself to identify and fix these resource hogs. And went on to state that in an ideal world the tool itself would generate configuration files to protect the system (stating this was unlikely to happen).<\/p>\n The following Apache modification options were discussed:<\/p>\n Taking the BDSM out of PCI with Open Source – Erin Jacobs and Zack Fasel<\/span> As most people who deal with it are only too painfully aware PCI DSS represents the Payment Card Industries, Data Security Standard.<\/p>\n The speakers have started the “Open PCI project.com”. With the aim to provide open source guidelines which are scalable, contain specific walk throughs and simple deployments via ready-to-go installations \/ virtual machines.<\/p>\n Although there are 12 PCI issues, the talk was only concerned about those that people are getting wrong, these issues in priority were:<\/p>\n Linux = traditional options have been: syslog or deploying an agent. CobraDroid – Jake Valletta<\/span> CobraDroid is a full-featured Android sandbox that includes the ability to modify device and radio identifiers, proxy network traffic with SSL validation bypassing, and perform per application method hooking, alerting, and packet capturing (and more!).<\/p>\n AppUse was discussed a closed source dynamic analysis tool.<\/p>\n CobraDroid setup: CobraDroid runs Android 2.3, provides both Bash and Busybox which offers a much more user friendly testing environment.<\/p>\n CobraDroid Functionality:<\/p>\n The tools SSL validation bypass allows you to man in the middle SSL connections!<\/p>\n Application specific packet capture, uses custom iptables rules, resultant pcap files can be viewed wire shark.<\/p>\n Uses method hooking to alert on method calls – configured via the file \/etc\/hooks.conf<\/p>\n Project website: http:\/\/thecobraden.com\/projects\/cobradroid\/<\/a><\/p>\n Real Time Analysis and Visualisation of Internet Status – Tiago Balgan Henriques, Tiago Martins, Joao Gouveia<\/span> Events are processed and analysed, as they happen, without storing large data volumes, enabling live actionable intelligence and rapid response capabilities for threat analysts and decision makers who want to stay ahead of emerging threats and opportunities or in other words “events, lots and lots of events”.<\/p>\n The huge amount and variety of data to tackle is difficult, a common API?<\/p>\n The speaker team have created a high performance scalable Complex Event Processor (CEP), uses streaming technology, follows publisher\/subscriber model. Events are all handled in JSON format.<\/p>\n “StreamForce” = CEP Once the form is submitted It is possible to display a geographic maps showing botnet activity, Zeus activity etc. For example it would be possible to show the biggest botnets in any specific country.<\/p>\n Lightening Talks – Day 1<\/strong><\/span><\/p>\n OWASP JAWS<\/strong> – Purpose: The purpose of the project is to have a workset with runnable java code that shows secure coding practices in a working way. Too many times developers end up at some developer forum where someone asks a question and the solutions (that may be working but not necessarily in a secure way) are copied and end up in production code:<\/p>\n https:\/\/www.owasp.org\/index.php\/OWASP_JAWS_Project<\/a><\/p>\n\n
\n<\/strong><\/p>\n\n
\n
\nWindows = Deploying an agent (most likely option) or integration with HIDS.<\/p>\n\n
\n
\n
\n
\n
\n<\/strong><\/p>\n
\nSetup Android SDK, Download archives from his site, create new AVD (may have missed a stage here, see slides for full details).<\/p>\n
\n<\/strong><\/p>\n
\nSearch forms are entered and used to query the API
\nReal time feed services from multiple sources i.e. Honeypots, DNS, mail protection products.<\/p>\n