Security G33k: owasp

Wednesday, 19 March 2014

Defcon Kerala, India

Earlier this month, we were given the honor to present our paper with my colleague (Vikneshwaran Veeran) at Defcon Kerala. I was surprised and happy when our paper was accepted by the Defcon Kerala team. Coincidentally, i presented a similar demo at two security seminars in Singapore. But the difference was this, Defcon Kerala is a group of security enthusiasts, programmers, bug bounty hunters, application and tool developers and of course HACKERS! Unlike the seminars i presented in Singapore where the audience were geared towards business users and IT professionals, conferences like Defcon are more techie and how should i put it: subject matter experts!

During the day of the conference, we were warmly welcomed by the team. It wasn't as big as the Defcon conference in Vegas (thank God!) but it was a great experience. We get to meet the creator and founder of Xenotix (Ajin Abraham), the creator of Mandiant OS, the creator of IronWasp (Lava Kumar), the WatsApp hacker (Anto Joseph), a hardware hacker (Yasheen) who was only 19 and many other talented individuals. We were humbled by both the speakers as well as the audience who possessed such great knowledge and enthusiasm for security. Throughout the presentations before ours, the speakers were speaking and demonstrating the latest tools and techniques pertaining to applications and source codes. My colleague and i were dumbstruck-ed as we asked ourselves "Are we in the right place to present something different?" especially when our presentation was geared towards the web application and network penetration.

Alas, when it was our turn to present, the hall was quiet. We felt a sudden silence and quickly set up the laptop to the projectors as my colleague starts to introduce ourselves to do the ice breaker. So ideally, this was how we prepared for the demo: For the introduction, my colleague will speak and when it comes to the demo, i will speak and when i started to run the demo, my colleague will continue the motion as to keep the presentation alive and not create any form of awkward silence in between.

During the demo, it was smooth but we encountered a small 2 minutes hiccup/delay. The 2 minutes delay was caused by the process of creating the payload. Usually it should be done within 30 seconds but at that point of time, it was not. After 1 minute, i started to look at my colleague and started to show signs of desperation. My colleague coolly told the audience about Murphy's Law. Well, i did prepare backups of the payload in case that doesn't work but after 2minutes, it did. Phewww!! Continue to the demo and when it finally completes, i was delighted. Sheesh, i stammered most of the time and even one of the audience jokingly commented that my 'accent' was funny. Argh!

After the presentation, we came up to some of the other speakers and complimented them on their great work and tools. A big RESPECT to them all. One of the speakers, the creator of IronWasp complimented our demo saying it was one of the most complicated demos he had seen and he was nervous and glad when it managed to pull it off. (imagine how nervous we were on stage!) That was such an awesome feedback.

After the conference ended we were swarmed by the members of the audience who spoke to us and took pictures with us. It was a great feeling. I also didnt miss the opportunity to take the photos with them as well. Whenever they took my pic, i will tell them "hang on, its my camera's turn to take". We managed to exchange contacts with them either via namecards or linkedin or facebook.

Overall, it was a great experience and i really thank the Defcon Kerala Team for organizing this event. I believed it was a fruitful event that everyone could take away, learning something new or at least spurn them into wanting to go deeper into security. Although this was the second year of this conference, i believed that this will go into something bigger, perhaps in a few years time, it will garner a much larger audience possible rivaling conferences such as Hacker Halted.

Here are some of the pictures of the event.

Friday, 18 October 2013

HITB (Hack In The Box) Security Conference in KL 2013

Went to the Hack in the Box Security Conference held in Kuala Lumpur on the 16th -17th October 2013. Hosted in Intercontinental KL hotel, the conference was great. This is my third time in three years attending this conference and i have grown to love them. The tracks were good, the booths were awesome, the competitions such as Catch the Flag and HackWeekday were superb. Check out some of the photos of the conference.

Good Points: I will not deny that the topics of the presentations were great. They covered almost every aspects of hacking but focuses more on in depth hackings such as:
> OS/Software
> Exploitation
> Hardware

Some of the cool talks presented were the Facebook Hacking, Aviation Hacking and both Keynotes. For the HITB crew, i have to compliment them all the way. They were very friendly and approachable willing to assist and help anytime when approached. The food was superb and a 5 star class! I cant complain anything at all about the food and no one had to stand to eat (like some of the other conference i've been). The theme of the CTF was also eye catching! 'War of the Worlds: WMD'!! I mean like, seriously?!!! Even if i participated and didnt win, i still would feel good bragging to my friends that i participated in such a cool theme CTF event! The HackWeekday or should i say coding of applications competitions were superb and it had a number of categories giving each competitors to join in their respective specialized field. I've participated in several CTF competition but have yet to join one in HITB, and maybe one day i shall join. However i do like to put it out there that upon talking to the organizers of the HITB CTF, i can say that it is not those kind of straight forward network/web hacking competitions. One of crew shared that it involves more than just network/web hacking skills. One needs to have a fundamental knowledge on cryptography, steganography, reverse engineering, source code understanding, exploit engineering and binary analysis.. i was like..say what!!! damn..that is one tough CTF and whoever wins it should be respected for knowing and having the knowledge of all the mentioned aspects of computer security. Kudos to the Vietnam team for winning this.

Room for Improvement Points: While the topics were great, some of the deliveries were not. One example is the inability of some of the speakers to convey it in proper English (as some of them were from Europe and South America). One of the speakers were speaking out of a word document all the way with little interactions with the audience. Another were speaking without knowing the full stop. It was cute actually.

What i hope to see: Local Speakers at least! While the conference were attended by many locals, unfortunately none of the speakers/presenters were. Although im not a Malaysian, i would love to see some locals presenting their research in the conference. And of course, more ladies please! I've been to these conferences and sadly i rarely see any women hackers speaking. However there were a handful and countable women attending the conference. I also would hope to see topics in regards to penetration testing such as advanced network/web recon/exploitation, bypassing firewall and Anti Virus techniques which could attract more ethical hackers in these fields to attend. While there were booths that were very interesting especially when there's a mini 'challenge' or 'competition' to attract people, some were quite dull (there was even an empty booth with a single person sitting at it). I was impressed by Mozilla booth, because twice i was there, twice they had mini challenges. Such mini challenges can be seen in world class conferences such as Def Con and Black Hat and HITB booth representatives could take some tips from them. The Lock Picking by Toools were also a force to be reckoned with. Unlike Facebook booth where they were packed with people for free gifts and tshirts, the lock picking booth managed to attract more people with its complex challenges and outgoing reps.

Overall: I enjoyed myself. Its much much better than some of the conferences i've been to such as Hacker Halted hosted in Singapore. What i enjoyed most is making new friends, network and exchanging name cards and knowledge. The in between breaks were designed for that (i think) and i ended up making new friends! Great hotel, great food, awesome conference....what more could you ask? I've been to many conferences over the years and i have to say that HITB is one of the top 3 conferences that is in my list of MUST GO!!! Congrats HITB and Thanks for the great conference!