Microsoft has posted videos and slides from the Microsoft internal “BlueHat” security conference from October 2014.
BlueHat Security Briefings educate Microsoft engineers and executives on current and emerging security threats as part of continuing efforts to help protect our customers and secure our products, devices, and services. BlueHat serves as a great opportunity for invited security researchers to informally connect with Microsoft engineers who are passionate about security, furthering a bidirectional exchange of ideas at the event.
The Following Session videos and slides are posted:
BlueHat 2014 Keynote – Chris Betz
Defining and Enforcing Intent Semantics at ABI level
(Sergey Bratus, Julian Bangert)
Dominant OS security policy designs treat a process as an opaque entity that has a “bag” of permissions to access some OS resources at any time, in any order. Now that the sensitive data that we most want to protect may never touch the filesystem or even cross a process boundary, these designs fail at their purpose. We introduce a design that has a much higher granularity of protection, yet is compatible with existing ABI, standard build chains, and binary utilities.UEFI – Summary of Attacks against BIOS and Secure Boot
(Yuriy Bulygin)
A variety of attacks targeting platform firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as BIOS and SMM, UEFI secure boot and Full Disk Encryption solutions. This talk will detail and organize some of the attacks and how they work. We will cover attacks against BIOS write protection, attacks leveraging hardware configuration against SMM memory protections, attacks using vulnerabilities in SMI handlers, attacks against BIOS update implementations, attacks bypassing secure boot, and various other issues. We will describe underlying vulnerabilities and how to assess systems for these issues. After watching, you should understand how these attacks work, how they are mitigated, and how to verify if your system has any of these problems.Botintime – Phoenix: DGA-based Botnet Tracking and Intelligence
(Stefano Zanero)
Its common knowledge that a malicious domain automatically generated will not become popular and also an attacker will register a domain with a Top Level Domain that does not require clearance. Hence, we use phoenix which filters out domains likely to be generated by humans. The core of Phoenix is its ability to separate DGA from non-DGA domains, using linguistic features.
Recent Comments