AdverGaming The System:
by Chris "PaperGhost" Boyd
(PDF)
In game advertising is becoming more visible (and in some cases, more intrusive) in the world of console, PC and mobile gaming. In many cases, disclosure related to what's happening with your PII is as bad (if not worse) than the poor practices of the Adware industry prior to clean ups brought about by the FTC and the NYAG.
Where is your data going? What are you consenting to when installing that "free" app? Which advertising networks are serving you "relevant" targeted advertising while playing the latest FPS?
From the first in game ad from 1978 to the present day where as many as 40+ EULAs compete for your attention while installing a "free" game, this presentation will look at the history, development and current state of in game advertising and how it affects you.
A Brief View In Prioritizing Website Security + Demo:
by N1tr0b
(PDF)
The talk is about the importance of prioritizing website security in different points of views. It provides "you" the audience enough information about the damages of exploitation of a website and how to put an end to it. Also a short security code work for the following attacks:
XSS ( Cross Site Scripting )
LFI / RFI ( Local File Inclusion / Remote File Inclusion )
SQLi (SQL Injection)
CSRF ( Cross Site Request Forgery)
RCE ( Remote Code Exploitation )
Keynote ++ Cyber Espionage - How to sell a country:
by Morris Fedeli
(PDF)
Morris Fedeli is a former ACS vice chair and PCS committee co-chair, holding diplomatic status, and a
former ASIO recruit working with NBI operatives and Interpol on exposing Cybercrime activities
within South East Asia.
A pioneer of public wireless in the Philippines and real time collaborative platforms, he possess
degrees in Computer Engineering, Science and Masters in Business/Technology and is the
CEO/Director of a number of companies with business interest in China, HK, Australia, Italy and
Philippines since 2002.
A humanist, he is an expert witness, magistrate, consultant/advisor and former International cyber
bank director who travels up to 30 countries a year sharing his wisdom with others.
With a background in the legal field, he is here today to provide us a business perspective to Cyber
Espionage and How to Sell a Country!
Espionage in Cybertopia: A Government's Tale:
by Sven "zedian" Herpig
(PDF)
Where once upon a time our coporate assets would be guarded by kevlar embodied and armed security guards, today our vaults are filled with the confidential information about our patents and designs, our secret recipes and technical knowhow as well as personal information about you - our client - what are your likes and dislikes, your favourite foods, movies and amusements, shopping habits, reading materials and recreational habits, right down to your secret desires!
Crypto and PKI - Weapons For Mass Liberation:
by Lawrence Hughes
(ZIP)
Crypto is your FRIEND. With even a low end PC you can do crypto that is provably impossible for even NSA to crack, IF you know what you're doing. One of the fundamental tools for living in cyberspace. Like the Colt .45, crypto is a great EQUALIZER. The combination of crypto, PCs and the Internet is one of the things the statists fear the most, and with good reason. Between you and me, the end-to-end nature of IPv6 will make it essentially impossible for the government to monitor or control the flow of information - combined with crypto that's a Weapon of Mass Liberation. A tool that should be in everyone's personal arsenal.
Understanding Sandboxes:
by Paul Sabanal
(PDF)
In the last couple of years we have seen how the introduction of sandboxing into some of most used software in the world has changed the software exploitation landscape. Since the release of Adobe Reader X, for example, there has been no publicly released exploit for it. However, most of us are not familiar with how these sandboxes work. Knowing how they work makes us understand their limitations, and makes us aware of what they can and they can't do to protect us.
Mac Binary Analysis: A Sn3ak Peak:
by Christopher Daniel So
(PDF)
With the increasing popularity of Mac OS X comes the increase in number of the malware that target the platform. Thus, it is imperative for reverse engineers to have basic knowledge in code analysis for this new platform. In this presentation, techniques of code analysis of Mac binaries for reverse engineers and additional background information will be presented.
Malware 101:
by Berman Enconado & Reginald Wong
(PDF)
We already know the impact of malwares in server systems. Understanding what malwares are in the general scope is not enough. We need to know how it looks like and what it really does. This paper aims to give an in-depth analytic perspective on different types of malwares. Most of the discussions here will identify malicious codes and show what those codes do.
SOUL System:
by Joshua Lat
(PDF)
The SOUL System is a secure online authentication system which involves a two-factor authentication scheme using a password and an ordinary hardware device as a security to- ken. The three main parts of the system are the website, the ordinary hardware device, and trusted third party. The website must first be integrated with the web API provided and then registered to the trusted third party website to allow two-factor authentication. The security token is any ordinary hardware digital container that contains ordinary files such as BMP and PNG files where the user's data are hidden. Examples of possible containers include a USB flash drive, a laptop, a cellular phone, and even a Dropbox folder. It must be registered to the trusted third party so that it can be used to register and login to SOUL System integrated websites. The trusted third party stores and provides the public keys of both the two-factor login enabled websites and the registered security tokens.
Surviving ROOTCON (ROOTCON 101):
by Encrypted84
(PDF)
The presentation will deal on how to survive at ROOTCON as CON-Goers. How ROOTCON was planned, how to contribute, how to be ub3rAw4s()me during the CON.
Encrypted with the Goons participation will also be discussing the on the day mechanics of the activities, such as Hackista Challenge, WiFi Warrior etc...etc....
Taking Down a Botnet - The Story Behind Rove Digital's Takedown:
by Ryan Flores
(PDF)
Last November 2011, the FBI has publicly announced the takedown and arrest of a cybercrime gang operating in Estonia. This presentation gives details on how Trend Micro was able to help the FBI in the take down and arrest, while also giving insight on the time span, scale and complexity of an operation of this nature.
Virtualization, A New Risk:
by Tikbalang
(PDF)
Virtualization may very well be one of those revolutionary paradigms that could fundamentally change the way we think about and approach computing. Benefits:
Vulnerability assessment of commonly available personal safety boxes in the Philippines:
by Jolly Mongrel
(PDF)
Personal safety boxes usually contains sensitive information such as, but not limited to; personal details in government registry forms, bank details, personal letters, memos, diaries, company documents and a lot more. The problem with these boxes stems from fundamental errors that could have been remedied at design conceptualization level. Moreover, lack of quality testing (adversarial pen-testing) and skewed functional priorities resulted in some boxes that could be opened surreptitiously; hence, compromise of its contents and further privilege escalation is possible beyond awareness. This presentation is done for research and consumer awareness purposes only.
Berman Enconado
Berman Enconado is a Senior Software Engineer for GFI Software, Inc., a security software company that provides IT solutions for small- to medium-sized businesses (SMBs). He has eight (8) years experience in the antivirus and info-sec industry functioning as a Malware Researcher & Analyst. Berman has given talks at several universities, such as the Mapua School of Technology, to inform and warn students of online threats that are fast becoming more prevalent and complex. He is currently based in Manila where the Philippine office of
GFI SecurityLabs, the research and development arm of GFI Software, is located.
Christopher "@paperghost" Boyd
Christopher Boyd is a Senior Threat Researcher for GFI Software, Inc. He is also a 6-time Microsoft®
Most Valuable Professional (MVP) awardee for Consumer Security and former Director of Research for FaceTime Security Labs. He has given talks at RSA, InfoSec Europe and SecTor, and has been thanked by Google for his contributions to responsible disclosure.
Chris has been credited for finding the first instance of a rogue Web browser installing without permission, the first Twitter DIY botnet kit, and the first rootkit in an IM bundle.
Chris is regularly quoted in relation to his work on gaming security issues.
Christopher Daniel So
Christopher Daniel So joined Trend Micro Incorporated in October 2009, and is currently a Threat Analyst in Trend Micro's Analysis Team, Core-Tech Department. He graduated from the University of Santo Tomas, Manila in April 2008 with a Bachelor's Degree in Electronics and Communications Engineering.
Encrypted84
Served as a ROOTCON Goon since ROOTCON 2 He is a Certified Ethical Hacker. He used to work as a security administrator for a leading financial company in the Philippines and is now working as a Security Consultant in Singapore. He hopes to share his inputs on how to better appreciate the con and to contribute not only to the con but to the security community. He is also a lover, not only of IT & security but also of games, beer and extra rice.
Jolly Mongrel
Jollymongrel is an avid fan of beautiful women, animals, plants, knowledge and etc. He believes that the most important thing in life is to celebrate it (while you are still an air-breathing creature roaming on Mother Earth's rolling breast) with fervor, humor and without hesitation. He is also a firm believer of the Girl Scout Oath: "On my honor, I will try: To serve God and my Country, To help people at all times, and To live by the Girl Scout Law."
Lawrence E. Hughes
Lawrence E. Hughes is a visionary in the information technology and computer security fields, with particular interest in secure digital communication and IPv6. An expert, with more than 35 years' experience in creating and developing security products,
Mr. Hughes has a long history of being a valued consultant in various global security companies.
Mr. Hughes founded InfoWeapons Corporation to create high quality, simple-to-use, end-user tools as a response to the general lack of secure communication and IPv6 Ready tools currently available. He has authored the book "Internet E-mail: Protocols, Standards and Implementations", having been heavily involved with Internet e-mail
security for many years. His book is still one of the leading books on E-mail.
Prior to founding InfoWeapons, he was the co-founder (along with Jay Chaudhry) and initial CTO of CipherTrust in the US. CipherTrust is the maker of the IronMail™ Hardened E-mail Proxy appliance. Before that, he was a Senior Security Consultant at VeriSign where he created and taught their certification courseware internationally. All throughout his career, he has been constantly creating products and courseware in the areas of cryptography, digital signatures, digital envelopes, digital certificates, Public Key Infrastructure (PKI), secure transport protocols
and secure E-mail, as well as hardened security appliances to protect digital communication.
Morris Fedeli
Morris Fedeli is a Key Note Speaker, TV/Radio Show Presenter, Business Trainer, eBusiness/ICT Consultant, Project Manager, Publisher, Expert Witness and University Lecturer. A qualified computer professional, lay magistrate, computer systems engineer and trainer, he holds several qualifications including an MBA in Technology Management/Information Technology from Deakin University.
N1trob
Home brewed PHP application developer specializing in security and application alternatives. He is the leader of a hacking group which is known in the underground hacking community for their different accomplishments. He writes for the ProjectX blog and is, lastly, an anime otaku. Not your average otaku who watches anime with subs - this dude knows how to read/speak/write Japanese [At a beginner level ;)]"
Paul Sabanal
Paul Sabanal is a senior researcher on the IBM Security Systems X-Force Advanced Research and Development team. He has more than a decade of experience in the security industry, starting out as a malware researcher and now focusing on vulnerability research and protection technologies prototyping. Together with his X-Force teammate and partner-in-crime Mark Yason, he has presented in the last two Blackhat USA conferences about sandboxing technologies employed in Adobe Reader and Flash Player, and in the process has discovered several sandbox escape vulnerabilities. Prior to this, he has also presented on the topic of reverse engineering C++ applications at Blackhat.
Reginald Wong
Reggie has been in the anti-malware industry for almost 10 years doing research on different types of malwares. He currently heads the heuristics team at GFI Software Philippines and aims to detect malwares before they get in to your system.
Ryan Flores
Research Manager for APAC, Ryan Flore has over 9 years of experience in computer security specializing in malware analysis, reverse engineering and various honeypot and detection technologies.
Sven "zedian" Herpig
Lecturer for Information- and Communication Technologies in the context
of National Security and International Relations. Communications
Consultant in the public sector. PhD Student in the field of 'Strategic
Implications of Cyberwarfare for the Nation-State'.
Tikbalang
Career security management professional whose qualifications include a degree in Computer Engineering; ISO27001 Probationary Auditor, Certified Ethical Hacker, MCSE, and MCSA:Messaging designations; and detailed knowledge of security standards, technologies and best practices. Seven years of protecting information with diverse experience and overall understanding in business governance, security operations and management, network infrastructure, systems engineering, and research and development.
Receives the Black Badge entitled them for free entrance for next years conference.
WiFi Warrior - No winner this year (/sad panda :-|)
The Secrecy (Red Test) - reached Level 8 (Richard Stagg and David Walker)
Hacker Jeopardy - (To Be Updated)