Today's Black Hat Europe 2013 update highlights a trio of Briefings that epitomize what Black Hat does best: taking highly technical infosec topics and drilling down to the stuff that matters. Each of these Briefings will occur at 10 on Friday, March 15th, so hard as it is, you'll have to pick just one.
We start with Alexey Sintsov's Honeypot That Can Bite: Reverse Penetration, which springs from the idea that defense can be aggressive. With the honeypot in place, he'll examine how you can filter out non-bot attackers, de-anonymize them, determine their skill level, and ultimately bring them under your control. Real-world examples will show how this scenario can play out, and no vulnerability, be it client-side, third-party, or socially engineered, will go untapped. Sintsov will illustrate why the reverse honeypot is useful, and just how effective it can be.
Another scenario: What if prying eyes could covertly penetrate the corporate boardroom? That's just the situation imagined by Moritz Jodeit, who conducted a case study on the popular Polycom HDX videoconferencing devices. In Hacking Video Conferencing Systems Jodeit will show you how to get systems-level access to these otherwise-closed devices and describe how to set up a proper vulnerability development environment. He'll also demonstrate the feasibility of remotely compromising Polycom HDX devices by exploiting a vulnerability in the current software's H.323 stack, and look ahead to the development of a full surveillance rootkit.
Last up: Sandboxing is a growing trend in enterprise security, but does what happens in a sandbox always stay inside? If you're thinking of attending Rafal Wojtczuk and Rahul Kashyap's The Sandbox Roulette: Are You Ready for the Gamble? you can probably already guess. A lack of sandboxing standards has led to a range of solutions without consistent capabilities or compatibility, so Wojtczuk and Kashyap will provide a comparison framework for different vendor technologies that is consistent, measurable, and understandable by both IT administrators and security specialists. They'll also explore each of the major commercial sandbox solutions, and predict likely future attack vectors.
As we mentioned, all three of these great Briefings happen concurrently, but don't despair! All Briefings are being recorded. You can purchase the video recordings from Source of Knowledge. This way you can watch the action anytime you want and not miss a second.
Black Hat Europe 2013 will take place March 12-15 at the Grand Hotel Krasnapolsky in Amsterdam. Be sure to check us out on Twitter and be our friend on Facebook.