Black Hat Day 4

Today started slow, but things picked up around 10 when I got a call that a bud had a line on a few extra invites to the Cisco party and wanted to know if I wanted to go,. responded with a resounding YES, so hopefully he was able to get the names in, in time. The class I've been taking for the most has been pretty cool, it was the Advance Malware Deobfuscation class, my one biggest complaint with this class is a lack of good step by steps for the student exercises, so we can go back later and re-work through the exercises if we want. I don't know about any of you but after taking two heavily compressed and very technical IT courses, followed by 5 days of in-depth technical briefings, and various Vendor parties, I'm going to need a few days to decompress and the ability to re-run through the course materials when I'm more well rested. I'm probably not alone in this so.....

To say lunch sucked would be giving it a compliment, it was that bad. Of course this just means I'm going to be "forced" to grab something quick from the Caesars snack area before the Qualys get together, then again that might be what Caesars had in mind in the first place.

Last break of the day found us attendees rushing to grab our delegate bags. This year they had multiple colors not just the typical Red/Black bag (three to be exact: Red/Black, Orange/Black, and Blue/Black are the three bag color combos that I can see.). I'm not sure what if any difference there will be between the bags but I did notice a larger number of Red/Black bags than the other two. While standing in line I over hear one of the people near the front ask for a specific color, the guy handing them out said they couldn't do that and they we had to take what we got. Well as I reached the front I notice a nice Blue/Black bag after the typical Red/Black I was a bout to receive... thinking quick I turn to the guy behind me and say go ahead man. He buys it, steps right up and gets the Red/Black bag. I then smile as I step up for the nice Blue/Black bag. The guy handing them out just smiles back and says: thats the sweetest hack I've seen today, that's getting it done! So now I have a nice Blue/Black bag. As I look through the bag I notice not only have the goodies improved over years past the number has have increased a little (guess they found out they save lots of weight and money by not printing out the big red books).
Besides the usual program/schedule, conf DVD there is a rather nice, hard cover flip up book journal (kind of like a steno pad but hard bound and much better looking, an especially welcomed for this southpaw), a highlighter that also includes a two color ball point pen, and a nice new PayPal/ebay Security Key fob. Again not sure how this differs from the other colored bags, but I'll do some schmoozing and find out.

Well class is over so it a quick call to the other half, a snack and then the Qualys!

Ish

Black Hat Dat 3 post 2.

The after noon class went a little slower then the morning portion did, mainly because many people in class were not already familure with OllyDbg. Once we got passed the intro to OllyDbg the class picked up a little more as we explored how to find the original entry point in a program. Day three ended early for me, by legs and back were ache from the uncomfortable chairs and since Monday is one of the most dead nights in Vegas I figured I'd just spend a quiet night watching a little Mythbusters and reviewing the days exercises. Besides tomorrow starts the real fun... Vendor parities :)

Ish

Black Hat Day 3 (up to lunch anyway)

At breakfast this morning we had a Jackalope sighting. For those not in the know, DJ Jackalope is probably one of the best spiners/mixers who are regulary asked to play Defcon. She has mad skills with the turn table and can crank out the tunes.

Today's class defiantly seems a lot better that my weekend class. We started off straight into how executable Windows binaries look in a hex editor then started from the beginning and stepped through what things mean inside that binary. Next we stepped through the PE header information and how to find certain items in side the header. So far this class looks to be a new must attend for any one interested in getting into Reverse Engineering or binary analysis. It's lunch so I don't have much time left.

More Later

Ish

Black Hat Day 2

I'm taking back something I said yesterday, Responder is cool but what really sets it apart is the wicked graphing feature that allows you to pull items on to the graph, as well as set layer colors (much like in adobe photo shop or Gimp graphics editing). You can turn off and on the layers so you can focus on a few items at a time. The graph also has a handy feature that allows you to "grow up" and "grow down" from an item on the graph. This means that you can add new items in the graph by following the associated function calls.

Tonight found a few us trying to answer the age old question: "Whats for dinner?". So we walked of Caesars and took a right and stated walking down the Strip towards the Luxor. After much indecision we finally wound up at the Hawaiian Tropic Zone at Planet Hollywood's Miracle Mile stores. We had passed over the place because of the price but finally decided to stop in because we acquired a buy one get one free entree. While higher priced the food was GREAT and it wasn't little portions either, they were huge! After dinner we were kinda wiped so we headed back to Caesars so we could slpit off and enter into food commas.

Ish

Black Hat Day 1

First things first, while my Internet access will be a little spotty, I'm going to be keeping a running journal of the events as the happen or soon after they happen, but I may not always be able to post to the blog on any given day or at any set time. I will post in order of occurrence but this means that some days there may be no postings, some there may be multiple (one for each day) and others may have multiple postings are continuations of the same day. Training today was okay wasn't exactly was I was expecting from the class description but by the end of the day it had picked up some. While Hogland and Cummings are very smart, the class was more geared tword using HBGary Responder for things rather then hard core rootkit reversing. One item of note they did present something they call Malware Analysis Factors (MAFs). These MAFs break down program functions into six categories. While these MAFs are cool and all, it remains to be seen if the rest of the class will improve. Don't get me wrong Responder is a cool tool and all its just I was expecting a little more from one of the founders of rootkits.org.

Dinner tonight was very disappointing, it was over priced and just kinda of anh. After dinner found me a few others at the Seahorse lounge in Caesars near the Pure night club. A few years ago it was a pretty good spot for people watching and reasonably priced for drinks. My how things have changed, they updated the part out side of Pure so that now they have the "Pussycat Dolls Casino" basically a just a small card table pit with a roulette wheel and craps table. While still a good place to people watch they jacked up the prices by almost triple so we probably won't be going back.

Ish

Vegas Here I come... BlackHat 08 /Defcon 16

In case any one is wondering why after my July 8 post I have been quite its because the wife, piggy, and I were taking a much needed break. I was also busy working a travel training issue at work so I could attend the upcoming Black Hat 08 and Defcon 16 conferences. While I can't promise I'll give a daily play-by-play I'll try to at least do a summary every few days.

If your also going to be there and wanna hang out or have some inside scopes on some of this year's unofficial events drop me a line.

Ish.

I'm Back

Sorry for delay but starting work on my master's, having a full time job, and taking care of the piggy hasn't left a lot of free time lately. Well all that is about to change, now that I'm more used to going to school again I can better manage my time and energy... So Ish's Cyber Wolf Den is back!!!!!

I'm hoping to continue with my weekly book reviews, along with posting on topics that interest me. So for those of you who have been checking in to find new content I thank you for hanging in there.

One item of note, with in the last couple of weeks Congress and the President passed a new MGIB program, and it looks to be a great new benefit that has been a long time coming. That said they still have a long way to go to better compensating our men and women who are now serving or have served.

Stay tuned to the wolf den more to come.

Isnala