The CCC has published a wiki article that advises its attendees on various practices to help them not get “hacked” during the congress itself. After all, security conferences like these are like warzones. 
The article touches on various aspects of security, including software and physical security. It also has a brief roundup on how to secure each system. Of course, there’s nothing too detailed and it might even be missing a couple of possible attack vectors, but the general idea is there.
It is pretty late for a mention of the last SSMG meetup, which occurred on 18th December at Red Hat Asia-Pacific, but I’m sharing this anyway. Eugene Teo spoke generally about the process of the handling of bug reports at Red Hat. A short biography of Eugene -
Eugene Teo works for the Red Hat Security Team (only one in AP). He focuses on Linux kernel security. He has been an active member of the Linux and open source community in Singapore for over a decade, having held different portfolios within the Linux Users’ Group of Singapore. Eugene has spoken at numerous conferences, including the Red Hat Summit, GNOME.Asia, and Linux Conference Australia.
Follow ups by Eugene through email
Hi all,
For those who attended my talk, thanks a lot. I hope you find it useful.
Here are a couple of notes that you will find useful:
- Red Hat published a risk report on the three years of Red Hat
Enterprise Linux 4. Feel free to read it at:
http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-enterprise-linux-4/
- How do you find out if Red Hat have fixed a particular named issue?
Most public security issues that affect Red Hat will already have an
assigned CVE number[1]. The CVE number will be formatted as
CVE-YYYY-XXXX where YYYY is a year, and XXXX is a 4 digit integer.
Use the Red Hat Network to see if we have issued updates that correct
this issue:
Example: http://rhn.redhat.com/errata/CVE-2008-3526.html
It is possible that an issue affects one of our products, but has not
had an update released yet. We track all known issues in bugzilla, and
place the CVE id in the summary line. Doing a bugzilla search for a
given CVE id should reveal if we are working on it.
Example: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-4554
If you do not see anything there perhaps this is an issue that for
some reason does not affect Red Hat. If so, we will have given an
official vendor statement to the National Vulnerability Database.
Example: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4618
[1] CVE stands for Common Vulnerabilities and Exposures (CVE). Check
Thanks, Eugene
Virus Bulletin 2008 Slides -
http://www.virusbtn.com/conference/vb2008/slides/index
ToorCon X Presentations -
http://security4all.blogspot.com/2008/11/toorcon-x-presentations-online-plus.html
OWASP 2008 Videos -
http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference
HITB Slides -
http://conference.hitb.org/hitbsecconf2008kl/materials/
I would like to say that I enjoyed Day 1 more than I enjoyed Day 2. However, today sported rather interesting activities as well.
But first, some photos with / of TOOOL USA
Deviant, Babak, yours truly
Eric was busy
It was perhaps the lab session which I had enjoyed the most.
Moving on to today’s activities – King Tuna and Q conducted the lab session for wireless and RFID.
Lab session conducted by Q and King Tuna
It took some time on Windows to find the general placement of the access point. Luckily, they had a VMPlayer installer as well as a BackTrack3 image that I could use. Cracking WEP wasn’t supposed to be hard, but due to an oversight in the channel number, I monitored the wrong channel and there wasn’t enough time to complete the crack.
Ching Tim Meng conducted the malware-removal lab. It was a pretty basic session that consisted mostly of general malware techniques and malware removal procedures. Perhaps a better option would have been “Decompilers and Beyond” by Ilfak Guilfanov and pdp’s “Client-side Security”. I would definitely like to catch videos of their presentations once they are published (around December?).
Currently, I’m waiting to go to the airport to catch the 2215 flight to reach Singapore by 2310. Definitely a better option than the 6-hour coach ride. Yay for Tiger Airways.
HITB 2008 is the first actual security conference that I have physically attended, although I have been watching videos and slides of various conferences, especially blackhat/defcon. There were a couple of interesting booths, namely CtF, Open Hack, Wireless Village and Lock Picking Village (LPV).
HITB Booth
CtF in progress
So HITB Day 1 commenced, with an introduction to Click-Jacking by Jeremiah Grossman as the first keynote address.
Jeremiah's Keynote Speech
Before I go into the details of his keynote speech, I need to iterate, and reiterate, that the emcee’s distasteful slang, accent and speech is, in no way, a representation of how people from Singapore / Malaysia speak. Perhaps the organizers realized that as well as we never heard that speaking style again, after two of his narrations.
Jeremiah shared a couple of interesting PoCs for Click-Jacking, including but not limited to – tapping of webcams and microphones through Flash Player, allowing of access to the local machine (again, through Flash Player), etc.
See the"Always allow" radio button? Imagine "Allow site to remember login credentials?" before that. Think Click-Jacking, think pwnt.
It was an interesting keynote address with interesting examples.
Marcus Ranum’s speech, on the contrary, was slightly boring in comparison. It was mainly theory and definitions, which didn’t interest me much.
There were two highlights of the event today (in my opinion).
1. Hacking Internet Kiosks by Paul Craig
Paul put together an interesting presentation on how to “hack” Internet kiosks – getting a shell, getting the taskbar to show, getting files downloaded / uploaded with notepad, bypassing kiosks blacklists, etc. He compiled an entire list of possible attacks in a simple AIO application – http://ikat.ha.cked.net/ – it even comes in a portable version! The presentation was attended by many and I’m sure everyone enjoyed it. Both the presenter and the content were deliciously juicy.
2. Lock-Picking Lab by TOOOLS
At Track III, which, IMHO, is the best track to be in because of its hands-on experience that you will get there (which you cannot get from just watching videos), TOOOLS gave our lock picks and sample locks for us to try picking and introduced a couple of techniques. Overall, this lab was well-received and many loved it.
Tomorrow, I’ll mainly attend the lab sessions. I’m sure I’ll learn a lot from them.
So I haven’t been posting lately, but hey, I was busy. Now that the busy period’s over, I’ve finally got time to get down to Kuala Lumpur, Malaysia, with Chalit to attend the HackInTheBox Conference 2008.Tomorrow’s the start of the conference, but since it starts at 9, we decided to check in a day earlier to prevent the mad rush that we would have otherwise need to go through tomorrow.
I was hoping to get to meet Petko and discuss about HoH and stuff over lunch, but it’s too bad he couldn’t make it. Congratulations, pdp! I’m sure your kid’ll be pretty. 
So, we booked Impiana Hotel, a lower-class hotel compared to Crowne Plaza Mutiara, where the conference is supposed to be carried out. Unlike most other hotels I inquired, this hotel does not have in-room WiFi access. It sports a single ethernet access point, which is supposed to provide a “high speed broadband connection”, but I guess that’s not exactly true, given that I’m downloading files from RapidShare at a mere 30kbps. It’s lucky that I inquired about the Internet access before booking, though. I came prepared.
I’m all geared up for HITB tomorrow. Are you?