Author: David Maynor
- Rootkits: A Catalog of Local Windows Kernel-mode Backdoor Techniques
Authors: skape & Skywing
- Static Analysis: Generalizing Data Flow Information
Author: skape
This volume of the journal can be found at:
http://www.uninformed.org/?v=8
* The OWASP Education Project - Martin Knobloch
* Dynamic Taint Propagation: Finding Vulnerabilities Without Attacking -
Matias Madou
* Threat Modeling for Application Designers & Architects - Shay Zalalichin
* Scanstud: Evaluating static analysis tools - Martin Johns,
* Office 2.0: Software as a Service, Security on the Sidelines? - John
Heasman
* How Data Privacy affects Applications and Databases - Dirk De Maeyer
* The OWASP Anti-Samy project - Jason Li
* Input validation: the Good, the Bad and the Ugly - Johan Peeters
Author: David Maynor
- Rootkits: A Catalog of Local Windows Kernel-mode Backdoor Techniques
Authors: skape & Skywing
- Static Analysis: Generalizing Data Flow Information
Author: skape
This volume of the journal can be found at:
http://www.uninformed.org/?v=8
We are preparing the third Static Analysis Tool Exposition (SATE).
Briefly, participating tool makers run their tool on a set of programs.
Researchers led by NIST analyze the tool reports. The results and
experiences are reported at a workshop. The tool reports and analysis
are made publicly available later.
The draft plan (including a summary of proposed changes since last
year) is at
http://samate.nist.gov/SATE2010.html
NIST is preparing the fourth Static Analysis Tool Expostion (SATE IV). Briefly, participating tool makers run their tool on a set of programs. Researchers led by NIST analyze the tool reports. The results and experiences are reported at a workshop. The tool reports and analysis are made publicly available later.
The draft plan, including a summary of proposed changes since the last SATE, is located at:
http://samate.nist.gov/SATE.html
In particular, we plan to provide the test sets by July 31. We plan to hold the wrap-up experience workshop in March 2012. Any suggestions regarding the plan would be appreciated.
We invite tool makers to sign up. If you would like to participate in the exposition, or if you have questions, please email Aurelien Delaitre (aurelien.delaitre 'at' nist.gov) or Vadim Okun (vadim.okun 'at' nist.gov).
* Non-x86 exploitation
* Fuzzing with SMT and its limits
* New classes of software vulnerabilities and new methods to detect
software bugs (source or binary based)
* Reverse Engineering tools and techniques
* Static analysis (source or binary, Lattices to blind analysis, new
languages and targets strongly encouraged)
* Unpacking
* Current exploitation on Gnu/Linux WITH GRsecurity / SElinux /
OpenWall / SSP and other current protection methods
* Kernel land exploits (new architectures or remote only)
https://www.sec-consult.com/files/SEC_Consult_Vulnerability_Lab_Pwning_Symbian_V1.03_PUBLIC.pdf
Abstract:
1. Perform static analysis of XIP ROM images (dumping, restoring import
and export tables, searching for unsafe function calls)
2. Enable run mode debugging of system binaries running from ROM, by
cracking the AppTRK debug agent
3. (Ab-)use the AppTRK debug agent as a foundation for dynamic
vulnerability analysis
• Secure application development
• Security of service oriented architectures
• Security of development frameworks
• Threat modelling of web applications
• Cloud computing security
• Web applications vulnerabilities and analysis (code review, pen-test, static analysis etc.)
• Metrics for application security
• Countermeasures for web application vulnerabilities
• Secure coding techniques
• Platform or language security features that help secure web applications
• Secure database usage in web applications
14h00-15h00 ? Fingerprinting hardware devices using clock-skewing ?
Renaud Lifchitz
15h00-16h00 ? A5/1 application & crack via GPU ? Gloire Gwendal
(Kalkulator?s Knights Project)
16h00-17h00 ? Stack Smashing Protector in FreeBSD ? Paul Rascagneres
17h00-18h00 ? Static analysis of a new kind of heap vulnerability ?
Julien Vanegue (Microsoft)
Party!
- --[ Workshops & Activities
from industry and academia working on the protection of software
systems against untrusted code. Untrusted applications should only
access those resources and only call those functions that are
considered as non-security-critical. Topics of interest include
security for intermediate languages like Java or .NET and interpreted
languages like Python or PHP, runtime monitoring, static analysis and
security architectures.
=
=
=
