***BEGIN THOTCON TRANSMISSION**********************************************

@@@@@@@   @@@  @@@    @@@@@@    @@@@@@@    @@@@@@@    @@@@@@    @@@  @@@  
@@@@@@@   @@@  @@@   @@@@@@@@   @@@@@@@   @@@@@@@@   @@@@@@@@   @@@@ @@@  
  @@!     @@!  @@@   @@!  @@@     @@!     !@@       @@!   @@@   @@!@!@@@  
  !@!     !@!  @!@   !@!  @!@     !@!     !@!       !@!   @!@   !@!!@!@!  
  @!!     @!@!@!@!   @!@  !@!     @!!     !@!       @!@   !@!   @!@ !!@!  
  !!!     !!!@!!!!   !@!  !!!     !!!     !!!       !@!   !!!   !@!  !!!  
  !!:     !!:  !!!   !!:  !!!     !!:     :!!       !!:   !!!   !!:  !!!  
  :!:     :!:  !:!   :!:  !:!     :!:     :!:       :!:   !:!   :!:  !:!  
   ::     ::   :::   ::::: ::      ::      ::: :::   ::::: ::    ::   ::  
   :       :   : :    : :  :       :       :: :: :    : :  :    ::    :

*** SPEAKERS **************************************************************

Confirmed 0x4 Speakers/Talk Titles
Keynotes (50 Minute)
  • Bruce Schneier - "Trust, Security, and Society"
    • Abstract: Human society runs on trust. We all trust millions of people, organizations, and systems every day -- and we do it so easily that we barely notice. But in any system of trust, there is an alternative, parasitic, strategy that involves abusing that trust. Making sure those defectors don't destroy the cooperative systems they're abusing is an age-old problem, one that we've solved through morals and ethics, laws, and all sort of security technologies. Understanding how these all work -- and fail -- is essential to understanding the problems we face in today's increasingly technological and interconnected world.
    • Bio: Bruce Schneier is an internationally renowned security technologist and author. Described by The Economist as a "security guru," he is best known as a refreshingly candid and lucid security critic and commentator. When people want to know how security really works, they turn to Schneier.
  • Josh Corman && Jericho - "Cyberwar!": Not What We Were Expecting
    • Abstract: With all the hyperbole and rhetoric surrounding "Cyber-War", we've grown blind to the real conflicts. Cyber-War is upon us, but it is NOT like you expected. Citizens are all involved (or will be), but we are not prepared. The conflicts don't have clean battle lines, aren't fought by or between traditional states, and are far more personal and idealogical. Historically, we have only seen cyberwar through failed analogies, or our own greedy lenses. In doing so, we have failed to give proper attention to the subject, let alone understand it. This talk will be more than an honest analysis of the past, present, and near future of cyber-war. From the DARPAnet goals of the Internet, to the original AntiSec's "inevitable conflict", to the guerilla warfare that we must come to understand, we'll outline what cyber-war isn't and, more importantly, what it is and will become. When the shit hits the fan, what role will you play? It's past time to prepare yourself; will you be a warrior, minute man, survivalist, or collateral damage?
    • Bio0: Joshua Corman is the Director of Security Intelligence for Akamai Technologies and has more than a decade of experience with security and networking software. Most recently he served as Research Director for Enterprise Security at The 451 Group following his time as Principal Security Strategist for IBM Internet Security Systems. Mr. Corman�s cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges plaguing the IT industry, and helps to drive evolutionary strategies toward emerging technologies and shifting incentives. Mr. Corman is a candid and highly-coveted speaker with engagements at leading industry events such as RSA, DEFCON, Interop, ISACA, and SANS. As a staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, and co-founded Rugged Software � a value-based initiative to raise awareness and usher in an era of secure digital infrastructure. His passion for challenging the status quo won him the title of Top Influencer of IT by NetworkWorld magazine in 2009. Corman received his bachelor�s degree in philosophy, graduating Phi Beta Kappa and summa cum laude, from the University of New Hampshire. He resides with his wife and two daughters in New Hampshire.
    • Bio1: Jericho has been poking about the hacker/security scene for over 19 years (for real), building valuable skills such as skepticism and anger management. As a hacker-turned-security whore, he has a great perspective to offer unsolicited opinion on just about any security topic. A long-time advocate of advancing the field, sometimes by any means necessary, he thinks the idea of 'forward thinking' is quaint; we're supposed to be thinking that way all the time. No degree, no certifications, just the willingness to say things many in this dismal industry are thinking but unwilling to say themselves. He remains a champion of security industry integrity and small misunderstood creatures.
FULL Length (50 Minute)
  • Phil Young - "Mainframes? What the F&#K is that about?"
    • Abstract: The mainframe is not legacy, far from it. Not only is it not legacy, but the majority of fortune 100 companies run a current and up to date mainframe OS. Airline, insurance, financial, power and oil industries, governments and three letter agencies, worldwide, run them, yet no one in the community knows how to properly tackle these 'iron beasts'. Be it a lack of access by the security community or the false notion that mainframes are dead, there is a distinct gap between the IT security world and the mainframe world. This presentation aims to help close this gap by talking about common security pitfalls on the mainframe and how you can take advantage of, or secure against, them. After this talk you'll be able to talk intelligently about mainframes, use SHODAN to find mainframes, enumerate and brute force users, crack the password database with John the Ripper and run netcat. Since mainframes are a big world, I will also show you how you can run your own mainframe at home on whatever old laptop you've got laying around using opensource software so that you too can get your hands dirty!
    • Bio: Ever since he saw the movie TRON, Phil has been fascinated with computers, mainframes especially. Throughout his career he's had the chance to review mainframe security at various large organizations. He has worked in IT security for 9 years but ever since he learned you could emulate your own mainframe he's been knee deep in JCL, print queues and OMVS. Some people build toy trains, others model airplanes, but Phil's hobby is mainframe security. He has given a talk about mainframe security at BSidesLV, has been interviewed for podcasts and maintains a blog about mainframe security research.
  • Shawn "lattera" Webb - "Runtime Process Insemination"
    • Abstract: Writing malware on Linux isn't an easy task. Anonymously injecting shared objects has been a frightful task that no one has publicly implemented. This presentation will show how and why malware authors can inject shared objects anonymously in 32bit and 64bit linux and 64bit FreeBSD. The presenter will be releasing a new version of a tool called libhijack. libhijack aims to make injection of arbitrary code and shared objects extremely easy. There will be a live demo injecting a root shell backdoor into multiple programs during runtime.
    • Bio: Shawn Webb is a professional security engineer. He has been studying and developing runtime process infection techniques for the past few years.
  • David Mortman - "Automating The Shit Out Of Security"
    • Abstract: Doing defense is hard. Time and budget are both limited resources . On top of that, many (most!) organizations are getting owned, not because the miscreants are talented, but because we aren't doing the basics very well. And why not? Because doing the basics if really really repetitive and boring. It's just not sexy so most people don't want to work on it. Repetitive tasks are not only boring, but are also error prone which makes the situation even worse. So let's automate the shit out of the boring stuff so we can focus on the complex and sexy stuff. Or as Ian Amit says, let's make defense sexy. I'll show you some cool ways to let computers do the stuff they are good at so we humans can do the stuff we are good at. Not only will there be sexy defense, but also (as is traditional) baked goods as well.
    • Bio: David Mortman is the Chief Security Architect for enStratus and a Contributing Analyst at Securosis. Most recently he was the Director of Security and Operations for C3, LLC. Formerly the Chief Information Security Officer for Siebel Systems, Inc., David and his team were responsible for Siebel's worldwide IT security infrastructure, both internal and external. He also worked closely with Siebel's product groups and the company's physical security team and is leading up Siebel's product security and privacy efforts. Previously, Mr. Mortman was Manager of IT Security at Network Associates, where, in addition to managing data security, he deployed and tested all of NAI's security products before they were released to customers. Before that, Mortman was a Security Engineer for Swiss Bank. Mr. Mortman is a regular speaker at RSA, Blackhat and Defcon. In the past year, he has presented at RSA, Secure360, Sector, Blackhat, Defcon and BruCon. Mr. Mortman sits on a variety of advisory boards including Qualys, Lookout and Virtuosi amongst others. He holds a BS in Chemistry from the University of Chicago.
  • Philip Polstra - "Mesh Stalkings"
    • Abstract: This presentation will show attendees how to use The Deck, an Ubuntu-based full-on penetration testing and forensics distro which runs on the BeagleBoard and BeagleBone family of boards, in a connected mesh network. The Deck is an open source system which debuted in London in September 2012. It contains hundreds of tools which have been ported to the ARM platform. Having a full system (complete with X Windows) in a small low-power package allows for great flexibility in penetration testing. The Deck can be run for days to weeks off of battery power. An entire penetration testing platform can be housed in a small child's lunchbox. This presentation will focus on the MeshDeck addon to The Deck. The MeshDeck adds ZigBee networking capabilities to The Deck. The addition of the MeshDeck adds considerable power and flexibility to an already powerful system. For example, a few BeagleBone versions of The Deck can be outfitted with ZigBee radios and then dropped at a customer site where they can run off battery power for an entire pentesting engagement while sending information on which networks/passwords/etc. they have cracked back to the pentester who is sitting in his car a mile away running TheDeck on his BeagleBoard complete with 7" touchscreen. This entire setup can bit fit into two lunchboxes. Attendees will leave with a better understanding of what is possible with small, low-powered devices. Attendees will also get an idea of what is required in order to port a Linux distro and/or applications to a new platform. An overview of ZigBee mesh networks will be presented. To get the most out of this presentation attendees should be familiar with penetration testing, and Linux. Experience programming in C would also be helpful, but not required.
    • Bio: Phil was born at an early age. He cleaned out his savings at age 8 in order to buy a TI99-4A computer for the sum of $450. Two years later he learned 6502 assembly and has been hacking computers and electronics ever since. Phil currently works as a professor at a private Midwestern university. He teaches computer security and forensics. His current research focus involves use of microcontrollers and small embedded computers for forensics and pentesting. Prior to entering academia, Phil held several high level positions at well-known US companies. He holds a couple of the usual certs one might expect for someone in his position. Phil is also an accomplished aviator with several thousand hours of flight time. He holds 12 ratings including instructor, commerical pilot, mechanic, inspector, and avionics tech. When not working, he likes to spend time with his family, fly, hack electronics, and has been known to build airplanes.
  • Robert Rowley - "Teaching your WAF new tricks"
    • Abstract: This isn't your uncle's "what's a WAF" talk, I'll be covering as many cool tricks and advance topics related to deploying Web Application Firewalls. I will show you how to write custom scripts using lua and mod_security, and give first hand experiences of how I used scripting with a WAF to put the security team at my previous job ahead of the game when dealing with web app attacks. I will be including the source code for these example scripts which can be used to provide automatic incident response, counter-intelligence and more.
    • Bio: A Security Researcher for Trustwave SpiderLabs, and part of the California security scene for the past decade. Previous to my work with SpiderLabs I worked as the security architect for a shared hosting company (who managed the web application firewall configuration for all 1mil+ websites hosted on the network).
  • James M. Drake - "Mobile security, forensics & malware w/ Santoku"
    • Abstract: Did you think there were a lot of mobile devices and platforms out there? Check out the hundreds of mobile tools being developed. We calculated it would take more time to install, test and maintain the various mobile tools than to actually fuzz the hell out all existing mobile operating systems. So, we created Santoku Linux, a F/OSS, bootable Linux distro to make life easier for mobile hackers. We pre-install not only the mobile platforms but promising tools in development. Santoku covers mobile forensics, mobile malware analysis and mobile security testing. This talk will introduce Santoku and provide demos of 1) how to forensically acquire and analyze Android and iOS devices, 2) several tools to perform security audits of mobile devices and apps, and 3) an approach to mobile malware analysis. All demos will leverage tools preinstalled on Santoku Linux. As a bonus, the talk will demonstrate another very different type of hacking. Throughout the talk, the sport of hacky sack (footbag) will be discussed and demoed including origins, how to play, why hacky sack is a great sport for hackers and how to perform different freestyle tricks. Audience participation will be encouraged.
    • Bio: James M. Drake is a mobile security researcher with a unique professional and educational background. After training in applied statistics and probability theory on the trading floors of the Chicago Mercantile Exchange, James became a successful independent trader of equities and commodities. His keen interest in electronics and information security led him to shift gears and pursue computer science and mobile security. At viaForensics, his area of research includes mobile exploits, JTAG, Android and iOS forensics. He has thus far decided to remain amateur in the sport of hacky sack.
  • David Schwartzberg - "Fun with Exploit Kits for Tech Support"
    • Abstract: Inspired by Adam Johnson's presentation at GrrCON 2011 titled "ZeuS - Inside Command and Control" on how to build a ZeuS bot Exploit Kit Command & Control. I thought it would be fun to use this newly gained knowledge to build a C&C in an effort to provide tech support for my mother in-law. Have you been in that situation where everyone you know comes to you with their computer problems? Just because you have a knack for technology, people you know seem to think that you enjoy fixing all their problems, most self-inflicted. Welp, here's your chance to help them and have some real fun. This mostly hand's on demonstration will walk through setting up your very own C&C and configuring the basic settings to get you started. When ready to rock, you will learn one way to get your victim to willfully become "infected" (inform them to disable AV first) and how you can have fun while fixing their problems. All of this will be covered while drinking beer and cooking bananas foster.
    • Bio: David Schwartzberg is a Senior Security Engineer at Sophos, a security company where he specializes in data protection. He is a co-founder of the Chicago InfoSec Underground meetup. David wrote the original CramSession study guide for the Network+ certification in 1999 and published "Computers for Kids: Something In, Something Out" in 2011. Utilizing his 6 years accounting experience and 17 years Information Technology experience, he speaks regularly with technology executives and professionals to help protect their corporate secrets and stay compliant.
TURBO Talks (25 Minute)
  • Dan Kuykendall - "Get off your AMF and don�t REST on JSON"
    • Abstract: HTTP is being used to transport new request formats such as those from mobile apps, REST, JSON, AMF and GWTk, but few security teams have updated their testing procedures. All of these new formats are potential new playgrounds for attackers and pen testers. You just need to know how to play. In this talk, Dan Kuykendall will demonstrate the process of breaking down these new formats and where to attack them on various vulnerable applications. Most of the attacks are the familiar classics like SQL and Command injection applied in modern applications. Attendees will learn to leverage their existing pen testing skills and techniques and apply them to these new formats.
    • Bio: Dan has been with NTO for more than 10 years and is responsible for the strategic direction and development of products and services. He also works closely with technology partners to make sure our integrations are both deep and valuable. As a result of Dan�s dedication to security, technology innovation and software development, NTO application security scanning software is often recognized as the most accurate because of its sophisticated automation techniques. Dan joined NTO from Foundstone, where he was a key developer of FoundScane�s scan management, and remediation capabilities. Before Foundstone, Dan was the founder of the Information Security team in the United States branches of Fortis. When Dan�s not working on NTO products or screen sharing with our customers to help them solve their application security challenges, you�ll find him blogging, co-hosting An Information Security Place Podcast and speaking at conferences like B-Sides, OWASP AppSecUSA, HouSecCon, ToorCon and more. He also works with industry groups and contributes to many open source development projects. Little known fact about Dan, he was a founder of the phpGroupWare project and creator of podPress.
  • int0x80 && FuzzyNop - "Incident Response Response"
    • Abstract: Attackers intending to maintain persistence in a network need to keep their tools and malware away from prying eyes. We regularly detect and identify systems compromised during campaigns, then acquire and analyze the tools and malware used in the attack. We are the prying eyes. Common mistakes made by attackers get their intrusions noticed, and their persistence removed. As a result, the attacker's tool or piece of malware finds its way into our instances of IDA Pro. In this talk we examine common mistakes made by attackers during targeted attacks. We also present approaches to remedy these mistakes. We will be releasing an open source tool that aims to thwart the identification of an attacker's tools or malware on a compromised system, and is thus, a response to incident response.
    • Bio0: int0x80 is the rapper in Dual Core.
    • Bio1: FuzzyNop is a guy who knows how to computer. As a child his parents always told him he should do computers and now he spends his free time making malware go backwards (aka reverse engineering malware). He is hopelessly addicted to CTF, and has competed in a number of CTFs including the US Cyber Challenge the past two years. This year his team won the DerbyCon CTF. At his day job he performs incident response and investigates intrusions related to targeted attacks, otherwise known as APT.
  • Josh "m0nk" Thomas - "Meshing Stuff Up"
    • Abstract: We want to crush all the misinformation and mesh all the phones. Tired of the cellular network going down or WiFi being untrustworthy? Join the SPAN team in a deep dive of mesh / mobile ad-hoc networking of Android devices. Before they were a team, the members of project SPAN thought it was highly limiting to only be able to network smart phones over standard Wi-Fi or with a Cellular infrastructure. Honestly, the SPAN team isn't a big fan of infrastructure-based networks in general. They wanted a headless, dynamic network that allowed for resilient communications when the other infrastructure either wasn't available or when they just didn't feel like using it. They also really liked the idea of a communication system where there was no central router, server or other central point of sniffing of data. With this in mind, they teamed up and created project SPAN (Smart Phone AdHoc Networks). They decided to open source the project and to share not only the code but also the whole process and idea with the community at large. The team is annoyed that the current generation smart phone radios have the intrinsic ability to communicate directly with one another, but hardware vendors and mobile OS frameworks don�t make it easy to do so. Let us show you how it can be done and the fun that can be had from it. Join the SPAN team for a deep dive into the Android network stack implementation and its limitations, an analysis of the Wi-Fi chipsets in the current generation of smart phones and a collection of lessons learned when writing your own network routing protocol. The team will also share a "How To" walkthrough into implementing your own Mesh network and incorporating general "Off Grid" concepts into your next project; this will include securing your mesh from outside parties while tunneling and bridging through the internet. The team will delve into specific Android limitations of Ad-Hoc networking and provide workarounds and bypass mechanisms. Lastly, the team will expound upon securing the mesh landscape and how to effectively evade traffic sniffing over an inherently open network.
    • Bio: Josh "m0nk" Thomas is a Security researcher, mobile phone geek, mesh networking evangelist and general breaker of things electronic. His past projects have commonly spanned the hardware / software barrier and rarely have a UI. He's spent the past 12 years poking at embedded systems, networks, IP stacks, AI and right-time communication systems. A code monkey at heart, m0nk has spent the last year digging deep into Android and iOS internals, with a major focus on both the network stack implementations and the driver / below driver hardware interfaces. He uses IDA more frequently than Eclipse, really just likes playing with gadgets and wants to make the world a better place. His life dream is to ride a robot unicorn on a moonlit beach. m0nk is currently employed by Accuvant LABS R&D Team.
  • Ben Ten - "Creating A Powerful User Defense Against Attackers"
    • Abstract: Does your security defense stop at the firewall, antivirus, logging, auditing, and the IDS? Regardless of the size or complexity of your perimeter security if your user clicks on a malicious link or opens an infected file it could still be 'game over' for your network. One of the strongest defenses is knowledge and empowerment. In this talk, I will show you how we were able to get our executives, IT team, and all of our users excited about security with a unique approach to User Security Awareness Training. I will show you examples of how we convinced everyone in our organization that they are a part of the security defense team. I will show you what worked and what didn't work when we implemented this in our organization. I'll talk about how these techniques that I used in an organization of 70 employees can work at organizations of all sizes. I will give you practical tools to sell the idea to your boss, sell the idea to your IT team, and sell the idea to your users which will help you create a powerful user defense against attackers.
    • Bio: Ben Ten is the Vice President of Information Systems and the Security Officer for a medical billing company in Illinois. I have 11 years of experience doing Application & Web Development; Security Implementation, Consulting, & Training (Blue Team); Federal Regulation and Compliance oversight in relation to Information Technology (HIPAA, HITECH, PCI); and managing a team of developers and IT professionals.
  • James Arlen - "The Message and The Messenger"
    • Abstract: You are a great person - a unique and special snowflake - you have many brilliant ideas. You are completely ineffective at getting those ideas out of your head and to an audience. If you need to stand up in front of a crowd of more than zero and persuasively deliver information - you need to be here. Whether delivering a status report or standing in front of an audience, there are ways to deliver information that will increase the chances that people will retain and act upon it. Join this fast-paced talk during which there will be some instruction, some ugly self-evaluation and path you can follow to get from *Idea* to *Delivery*. Stop presenting like crap and failing to get your point across.
    • Bio: James Arlen, sometimes known as Myrcurial, is a security consultant at Leviathan Security Group usually found in tall buildings wearing a suit, founder of the Think|Haus hackerspace, contributing analyst for Securosis, columnist at Liquidmatrix Security Digest, Infosec geek, hacker, social activist, author, speaker, and parent. He�s been at this security game for more than 19 years and loves blinky lights and shiny things.
  • Jonathan Claudius - "Attacking Cloud Services w/ Source Code"
    • Abstract: It is a lot of work to ensure that an open source project runs the correctly on all of its supported platforms. Fortunately, there are a growing number of cloud-based services that offer to remove this tedium, and for free! They will download, compile, and *execute* your code and let you know if everything goes as planned. This presentation will explore attack scenarios that could happen if malicious source code is fed into these services and provides perspective, advice and a new tool to help defend them from compromise.
    • Bio: Jonathan Claudius is a Security Researcher at Trustwave. He is a member of Trustwave's SpiderLabs -the advanced security team focused on penetration testing, incident response, and application security. He has eleven years of experience in the IT industry with the last nine years specializing in Security. At Trustwave, Jonathan works in the SpiderLabs where he focuses on vulnerability research, network exploitation and is the creator of the BNAT-Suite. Before joining SpiderLabs, Jonathan ran Trustwave's Global Security Operations Center.
  • Daniel Peck - "Scripting Android Applications"
    • Abstract: This will be a walk-through presentation on dynamic exploration of Android apps using JRuby. We'll give an overview of the entire process, beginning with tools to disassemble the package, followed by a crash course in understanding smali disassembly, modifying, and rebuilding APKs. Finishing up with a tutorial on running code from a targeted android package within a jruby session and a discussion on what this allows us to do, such as access APIs restricted to mobile only, extraction of secret keys, and bypassing/calling custom crypto routines. We'll conclude with discussion of popular obfuscation techniques that reversers are likely to encounter when performing this work, and a few quick dives into popular apps to show audience members what to expect.
    • Bio: Peck is a Research Scientist at Barracuda Labs at Barracuda Networks. He's interested in studying the security implications of and malicious messaging on social networks, and industrial control systems, and reverse engineering. He has a Bachelors of Science in Computer Science from the Georgia Institute of Technology.
  • Mike Kemp - "Everything Old is New Again"
    • Abstract: A lot of talks focus on the shiny new tech (*cough* Android *cough*). It�s understandable. If as a researcher you find 0day in this months latest hot technology you are almost certainly getting press coverage, which means either your salary / day rate is increasing, or you are getting a better job. Sadly, so called �legacy� technology is often ignored (it certainly isn�t mentioned much in most talks or books). Organisations that provide critical infrastucture do not ignore legacy technology, and neither should any penetration tester that claims to know their craft. This talk will look at some of the more often ignored legacy systems, and how to assess them without knocking over huge chunks of an internal estate. Topics covered will include, AS400, why RFI still works, VMS, PBX, X.25, SCADA PLCs, and all manner of �old� stuff you can find deployed in the real world. There will be no *significant* 0day (although the author does have some juicy details on SCADA systems and PLCs), but attendees will hopefully come away fired up and wanting to play with some old school tech.
    • Bio: Michael is an experienced UK based security consultant, with a specialization in the penetration testing of web applications and the testing of compiled code bases and DB environments to destruction. As well as the day job, Michael has been published in a range of journals and magazines, including heise, Network Security, Inform IT and Security Focus. To date, Michael has worked for NGS Software, CSC (Computer Sciences Corporation), British Telecom, and a host of freelance clients throughout the globe. Presently, Mike is working in a day job for Xiphos Research Labs (which he really has no choice in as he set it up). When not breaking things, Michael enjoys loud music, bad movies, weird books and writing about himself in the third person. Mike has previously presented at security conferences in Jakarta, Hawaii, New York, Los Angeles, Warsaw, Prague, Holland, Zagreb, Krakow, Quebec, and London (on subjects as diverse as virtualisation, malware, and why the government sucks), and is always keen to embarrass himself in new and exotic locales.
  • VideoMan - "Hack your Raspberry Pi, & Hack w/ your Raspberry Pi"
    • Abstract: All the fun things one can do with this little embedded box of fun! I'll talk about my experiences, such as WarDriving, Sensor input, and making a CatFeeder for fun! I'll give a demo of All the fun tools that one can run on this cheap hardware.
    • Bio: David "VideoMan" Bryan has more then 10 years of computer security experience, including pentesting, consulting, engineering, and administration. As an active participant in the information security community, he volunteers at DEFCON, where he designs and implements the firewall and network for what is said to be the most hostile network environment in the world. In his spare time he runs the local DEFCON group, DC612, is the president of The Hack Factory, and helps to run THOTCON as an OPER.
Workshops (2.5 Hour)
  • Jim Rennie && Marcia Hofmann - "Hacker Law School"
    • Abstract: Many law presentations at hacker conferences cover recent legal advances or highlight specific issues. But what about the baseline knowledge you need to just stay out of trouble during your online interactions? Come to Hacker Law School, and learn the basics!
    • Bio: Jim Rennie is an attorney, and is currently Senior Product Counsel at TRUSTe in San Francisco, where he specializes in Internet privacy law, among other things. Previously, he was has been Public Defender and a software developer. He has spoken around the country on topics concerning law and technology.
  • Bob Weiss - "Crypto for Hackers"
    • Abstract: Cryptography has been the weapon of choice for generations of spies, generals, and governments. Today, crypto is the foundation for secure communications, e-commerce, and online anonymity. Yet crypto still gets cracked or brute-forced. What gives? Crypto is like a parachute -- it's dangerous to roll your own unless you're a professional. Nobody can make you a pro in 2 1/2 hours, but this workshop will give you a working knowledge of cryptography -- from the fundamentals to commercial and military-grade ciphers. Not only will you understand what happens "under the hood", but you'll know the difference between major encryption algorithms, and have better insight into what ciphers are better than others for particular applications.
    • Bio: Bob Weiss is the founder of Password Crackers, Inc. and a Defcon Goon. He specializes in Cryptanalysis and has spoken numerous times crypto topics.
  • Ryan Linn - "Effective Network Hacking with Metasploit"
    • Abstract: Once you've compromised your first box with Metasploit, it's easy to identify how it can make portions of the penetration testing process easier. It takes time and experience to help optimize processes, and this workshop will help pen testers who already have a basic familiarity with Metasploit get faster results using the built-in database, basic scripting, and using modules that aren't part of the standard on-line demos. After 2.5 hours, you should have a handful of effective tips that will make your next test flow better and achieve better results in a shorter period of time.
    • Bio: Ryan Linn is a Senior Consultant with Trustwave's SpiderLabs -the advanced security team focused on penetration testing, incident response, and application security. Ryan is a penetration tester, an author, a developer,and an educator. He comes from a systems administration and Web application development background, with many years of IT security experience. Ryan currently works as a full-time penetration tester and is a regular contributor to open source projects including Metasploit and BeEF, the Browser Exploitation Framework.
Newbies (25 Min Minute)
  • Anthony Kasza - "Proactive Defensive Security Prescriptions"
    • Abstract: This talk intends to describe the design of a system which communicates active threats between individual HIDS. By communicating knowledge about malicious sources, analogous systems can proactively defend themselves from known bad actors. The system is built using Trend Micro�s OSSEC and the Linux BASH.
    • Bio: Anthony Kasza is an Internet security enthusiast and packet junkie.
  • PhreakingGeek - "Y U NO Sanitize bro?"
    • Abstract: Many people use eBay as a means of purchasing low priced tech gear, more times than not the gear that's being sold is coming from somebody upstream (directly or indirectly) with a much bigger budget. How does that gear get to eBay? What happens when your corporation uses a recycling company to get rid of parts your infrastructure? This will be a quick look into what happened when I purchased a switch off of eBay with a bad PSU. As always the config had not yet wiped amongst multiple other mistakes... Using what we have we will quickly run through how somebody of a less discerning background may exploit every bit of the haphazardly provided information. More specifically... we will use "OSINT" to map out who the seller is and run through a scenario of having him lead us to his storage locker full of recycled hardware so we can steal it and potentially more of the secrets that are hiding on this gear.
    • Bio: I like turtles, Malware's pretty cool too.
***END THOTCON TRANSMISSION************************************************