HITB Dubai 2008 Wrap Up

First of all, thanks to HITB crews, sponsors, speakers and all the attendees to make this happen again. We also thank to Dhillon(HITB Founder) for giving us(me and spoonfork) opportunity to present this time. Lets talk about some craps first -

1. Dubai hotel is expensive!
2. The hotel foods are always the same!
3. Pizza express is nice!
4. We always have great support from Army!
5. Dubai Gold Souk has too much golds!
6. Rufio and Niresh are upset because of .....!
7. I met all the cool people there!
8. The conference party is real fun because we get to hang up with beers!

Here's the sum up of all the presentations that I have attended -

Bruce Schneier
Schneier On Security

Bruce talks about the distance between the feeling and reality of security. I'm not really a guy who emphasizes on conceptual or semantic, however I think people will never get it right between the believe and reality, the line is blur because you can never educate the masses about the technologies that keep evolving from time to time.

Jeremiah Grossman
Hacks Happen
Jeremiah is statistics man, and of course the numbers tell you the changes of threat landscape and that's not really big surprise. He concluded all the quantitative data from different sources to give you macro view of current vulnerabilities and threats state. The web attack is popular as it becomes important business platform, remember the popularity brings paparazzi. And again we can't really defend ourselves from "just surface or 1st day' attack(I don't call it 0 days as the technique is already used) because we don't understand them. The summary is pretty simple, hacks happen .... all the time. That guarantees we won't be jobless too ;P

Christopher J.Rouland
Advances in Intrusion Detection and Prevention

I don't know Christopher personally, I attended his talk because the topic has something to do with intrusion detecion, seriously there's nothing really new or advance if you are following cutting edge intrusion detection technologies for long time. Most of the time Christopher is just explaining what IBM ISS offers and they are better than other vendors in comparison. Their system also emphasizes on session data by importing NetFlow data and we can't consider it as new stuff(think NSM). We are seeing more and more vendors taking session data seriously now.

Alessio 'mayhem' Pennasilico
VoIP (in)Security - Italians Do It Better

Alessio talked about his experience of making fun with voip system during CCC in Italy, I like his term of spitting, you should check out his presentation slide once it is up online. I would say fear the embassy who can reach you anytime, that's really entertaining talk from Mayhem. He also demonstrated the device which can change the voice at the end of the talk.

Marc Weber Tobias

How We Cracked Their Codes: A Case Study in Compromising the Most Popular High Security Lock in America - Medeco m3 and Biaxial
I'm not into lock domain or I know nothing about it at all, however I'm really impressed with Marc's work to crack the lock, and respect his 40 years passion in the same domain. I'm just 5 years old in network security industry and hope I can keep my passionate to network security field like he does.

Cesar Ceurrudo

Token Kidnapping

Cesar is the CEO of ArgenISS who sponsored our conference party, he showed us the weakness of design flaw in latest windows technology by kidnapping the token of particular process threads and you can gain the access priviledge to do anything you want. This is not something that can be fixed easily and therefore he has informed Microsoft before the presentation. If you want to know more about it, feel free to check out his presentation slides.

Walter Goulet, Viviana Basso and Benjamin Hagen
Real World Attacks Against 3G Networks Using Subscriber Devices

This is the talk from Motorola guys, they discuss their experience of penetration testing for 3G Networks, their conclusion is pretty simple, most of the security issues derive from the deployment phase where the party that setting up the network has to meet the timeline and leave most of the devices with default setting. As long as they are connected to the IP networks, you can basically probe them easily.

Alexander Kornbrust
Practical Oracle Forensics

I'm not database expert and don't know anything about Oracle at all(I use MySQL or PostgreSQL), I like Alexander's formalized approach to perform forensics process on Oracle Database System, he classifies different kind of malicious attackers with different kind of purposes and attentions, by knowing what kind of malicious attackers you are dealing with, you know what kind of sql statement will be queried by them, and that's really good lead to figure things out. Alex is really a bright guy and he shares his stuffs, he has written the scripts to retrieve all the necessary information to find culprits and evidences from the database system. I'm wondering if similar approach can be applied to MySQL and PostgreSQL and maybe should start looking up on this.

Petko D Petkov

For My Next Trick… Client-Side Hacking
Adrian 'pagvac' Pastor
Cracking into Embedded Devices and Beyond!

Pdp and Adrian are both thinktankers from Gnucitizen, I'm one of their blog readers(as always you can't forget about offensive security techniques while you are in defensive side), they are concluding their works of client side hackings and embedded devices cracking. If you are their blog reader, you should be familiar with all the stuffs they are sharing during the presentation, I like their single slide explanation where they only show the meat of particular hacking trick so that you can understand them easily. I think they are trying to deliver the mindset of "hacking through simplicity" and it will just work most of the time.

Mel(Spoonfork) and I presented Defensive Network Security, this is the first time we deliver our talk in Dubai, I hope whoever have attended our talk enjoy it and thanks to the 22 years old Amy for not sparing even 5 minutes.

I miss some of the presentations as both presentation tracks were running at the same time, anyway I will grab their presentation slide once they are online. Overall I enjoy the HITB conference in Dubai this time(congrates to Rufio as the new CTF overlord this time, hopefully you will suffer for another few years).

This conference party was organized on the cruise, and I bet everyone was enjoying the alcohols after "long fasting". See you guys in next HITB Conference again!!!!!

Cheers (;])