DAY 1 ( 26th April 2012 )

TIME	TOPIC	SPEAKER
0800 - 0900	Registration
0900 - 0915	Opening and Welcome Address	Thomas Lim Organiser, SyScan'12, CEO, COSEINC
0915 - 1015	Heaps of Doom Windows 8 developer preview was released in September 2011. While many focused on the Metro UI of the operating system, we decided to investigate the memory manager. Although generic heap exploitation has been dead for quite some time, intricate knowledge of both the application and underlying operating system's memory manager have continued to prove that reliable heap exploitation is still achievable. This presentation will focus on the transition of heap exploitation mitigations from Windows 7 to Windows 8. We will be examining the inner workings of the Windows memory manager for allocations, de-allocations and all additional heap-related security features implemented in Windows 8. Also, additional tips and tricks will be covered providing the attendees the proper knowledge to achieve the highest possible levels of heap determinism.	Chris Valasek & Tarjei Mandt
1015 - 1030	Coffee Break
1030 - 1130	De Mysteriis Dom Jobsivs The EFI firmware used in Intel Macs and other modern systems presents some interesting possibilities for rootkit developers. This presentation will provide a full account of how an EFI-based rootkit might work. We will begin with some background on the EFI architecture - what it does, how it works, and how we can leverage EFI to inject code into the Mac OS X kernel or attack the user directly. We will then detail how a kernel payload might work, employing a number of rootkit techniques that can be used within the XNU kernel. Finally, we will discuss the possibilities for rootkit persistence that are presented by EFI. This presentation will leave the audience with an understanding of the ways in which EFI can be used in a modern Mac OS X rootkit.	Loukas
1130 - 1230	Owning entire organisations with regional software they've never heard of Outsourcing is great right? Cheap labor/First to Market/Exploiting resources are all excellent reasons to set up a remote office. The problem in defending your newly acquired revenue center is that you cannot replicate your security practices and expect them to succeed against local threats. If you deployed the most popular/expensive US based security products would you feel protected? In this talk we will use South Korea as a case study. A short introduction to the criminal hacking scene in Korea will be given, and then a demo of us bypassing enterprise security solutions with a 0day in one of the most popular word processors in Korea (99% penetration) will be shown. How popular is that p2p client Xunlei in china? Why do state of the art malware detection appliances fall short? All this and more after Ben Nagy talks about fuzzing; don't miss it!	Ryan MacArthur & Beist
1230 - 1330	Lunch
1330 - 1430	I/O, You own: Regaining control of your disk in the presence of bootkits Master Boot Record based rootkits (MBR rootkits, or bootkits for short)have existed for decades but are more recently gaining widespread attention with the growing deployment of nasty bootkits such as TDL4 and Popureb. The most advanced versions of these rootkits hook the normal storage device stack (i.e., "normal I/O path") at the lowest possible level in order to hide the infected MBR and malicious components: the port and miniport drivers. This presentation will introduce a novel technique to read/write to disk using an alternate I/O path provided by the operating system: the crash dump I/O path. This poorly documented crash dump path represents a pristine, untargeted I/O path to disk, effectively defeating all known I/O-hooking rootkits. In addition to providing the attendee with original research and a new methodology for defeating bootkits, this presentation will offer extensive insight into the poorly-understood crash dump mechanism used by Windows. This research is a result of weeks of debugging and reverse engineering various disk drivers and operating system core features. This presentation will distill all of those details into simple important facts for the attendee's consideration.	Aaron LeMasters
1430 - 1445	Break
1445 - 1545	Entomology: A Case Study of Rare and Interesting Bugs To be updated	James Burton
1545 - 1600	Coffee Break
1600 - 1700	Exploiting the Linux Kernel: Measures and Countermeasures Kernels are soft targets. But getting harder. Even the Linux kernel. Ha ha, just kidding. OK, only 90% joking. Some people care about kernel exploitation these days, partially due the increasing need to pop application sandboxes. Apparently, people even care about Linux kernel exploitation since owning a bunch of Android phones is the new hotness. This presentation will look at the state of Linux kernel exploitation: the latest and greatest techniques, how exploitation has gotten slightly harder over the past few years, and what challenges lie ahead for the offensive-minded in the near future on both vanilla and hardened kernels.	Jon Oberheide
End of Day 1
1700 - 2000	SyScan'12 Networking Party

The organizer reserves the rights to change the program.

Patron of SyScan:

Platinum Sponsor:

Gold Sponsor:

Silver Sponsor:

Mega Sponsor:

Media Supports: