Discussion:
Call For Papers - hack.lu 2010 - 27-29 October - Luxembourg
Alexandre Dulaunoy
2010-04-04 16:50:51 UTC
Permalink
Call for Papers Hack.lu 2010

The purpose of the hack.lu convention is to give an open and free
playground where people can discuss the implication of new
technologies in society. hack.lu is a balanced mix convention where
technical and non-technical people can meet each others and share
freely all kind of information. The convention will be held in the
Grand-Duchy of Luxembourg in October 2010 (27-29.10.2010). The most
significant new discoveries about computer network attacks and
defenses, commercial security solutions, and pragmatic real world
security experience will be presented in a three days series of
informative tutorials. We would like to announce the opportunity to
submit papers, and/or lightning talk proposals for selection by the
hack.lu technical review committee. This year we will be doing
workshops on the first day and talks of 1 hour or 30 minutes in the
main track the two following days.



Scope ======

Topics of interest include, but are not limited to :

* Software Engineering and Security
* Honeypots/Honeynets
* Spyware, Phishing and Botnets (Distributed attacks)
* Newly discovered vulnerabilities in software and hardware
* Electronic/Digital Privacy
* Wireless Network and Security
* Attacks on Information Systems and/or Digital Information Storage
* Electronic Voting
* Free Software and Security
* Assessment of Computer, Electronic Devices and Information Systems
* Standards for Information Security
* Legal and Social Aspect of Information Security
* Software Engineering and Security
* Security in Information Retrieval
* Network Security
* Forensics and Anti-Forensics
* Mobile Communications Security and Vulnerabilities



Deadlines =========

The following dates are important if you want to participate in the
CfP

Abstract submission : no later than 1st June 2010

Full paper submission : no later than 15th July 2010

Notification date : mid of August


Submission guideline ====================

Authors should submit a paper in English up to 5.000 words, using a
non-proprietary and open electronic format. The program committee
will review all papers and the author of each paper will be notified
of the result, by electronic means. Abstract is up to 400
words. Submissions must be sent to http://2010.hack.lu/cfp/

Submissions should also include the following:


1. Presenter, and geographical location (country of origin/passport)
and contact info.
2. Employer and/or affiliations.
3. Brief biography, list of publications or papers.
4. Any significant presentation and/or educational
experience/background.
5. Reason why this material is innovative or significant
or an important tutorial.
6. Optionally, any samples of prepared material or outlines ready.
7. Information about if yes or no the submission has already
been presented and where.

Presentations/topics that haven't been presented before
will be rewarded.


The information will be used only for the sole purpose of the hack.lu
convention including the information on the public website. If you
want to remain anonymous, you have the right to use a nickname.

If the paper is not accepted in the main track, it could be accepted
in short or lightning talk session but in this case the speakers'
privileges are not applicable.

Speakers' Privileges ====================

* Accommodation will be provided (3 nights)
* Travel expenses will be covered up to a max amount
* Conference speakers night

Publication and rights ======================

Authors keep the full rights on their publication/papers but give an
unrestricted right to redistribute their papers for the hack.lu
convention and its related electronic/paper publication.

Sponsoring ==========

If you want to support the initiative and gain visibility by
sponsoring, please contact us by writing an e-mail to info(AT)hack.lu

Web site and wiki =================

http://www.hack.lu/

CfP website : http://2010.hack.lu/cfp/
Mayank.2.Bhatnagar
2010-05-19 11:12:02 UTC
Permalink
Hi everyone,

We are able to collect several samples of Zeus bot and there are many variants of the same.
However when we try to analyse it in our sandbox and closed environment, we are not able to get any activity.
There are several reports available, which are for same md5sum sample but still after much of analysis and triggering attempts, either the malicious sample dosnt trigger or if it does, it doesn't show any network activity.

What could be the reason? Where is the catch?? We have referred Zeus tracker sites (https://zeustracker.abuse.ch/blocklist.php), threatExpert reports but precisely what kind of analysis should be done and what environment created to analyse these setups.

We found that Vmware/Virtual setups may have been getting detected, but what abt a live sandbox environment. Why is the malicious exe not triggering there?? Where are we missing?

Anyone having pointers, suggestions...please suggest.
Thanks a lot,

Regards,
Mayank,
India
Michele Zoerb
2010-05-19 15:39:07 UTC
Permalink
Interesting thoughts as I am just starting the same type of project. I want to get infected by Zeus and perform some analysis. I have a closed environment, but didn't think that detecting a virtual environment would be an issue for the bot. I will put my VMconverter onto a separate machine and clone from there.

Any tips on how to selectively get infected with Zeus?

Thanks,
Chele

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On Behalf Of Mayank.2.Bhatnagar
Sent: Wednesday, May 19, 2010 4:12 AM
To: honeypot honeypot
Subject: info reg Zeus bot detection and analysis

Hi everyone,

We are able to collect several samples of Zeus bot and there are many variants of the same.
However when we try to analyse it in our sandbox and closed environment, we are not able to get any activity.
There are several reports available, which are for same md5sum sample but still after much of analysis and triggering attempts, either the malicious sample dosnt trigger or if it does, it doesn't show any network activity.

What could be the reason? Where is the catch?? We have referred Zeus tracker sites (https://zeustracker.abuse.ch/blocklist.php), threatExpert reports but precisely what kind of analysis should be done and what environment created to analyse these setups.

We found that Vmware/Virtual setups may have been getting detected, but what abt a live sandbox environment. Why is the malicious exe not triggering there?? Where are we missing?

Anyone having pointers, suggestions...please suggest.
Thanks a lot,

Regards,
Mayank,
India
Younger Tyler
2010-05-19 20:06:34 UTC
Permalink
Any tips on how to selectively get infected with Zeus?


You can find the latest Zeus variants here http://www.malwaredomainlist.com/mdl.php

Tyler

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On Behalf Of Michele Zoerb
Sent: Wednesday, May 19, 2010 11:39 AM
To: Mayank.2.Bhatnagar; honeypot honeypot
Subject: RE: info reg Zeus bot detection and analysis

Interesting thoughts as I am just starting the same type of project. I want to get infected by Zeus and perform some analysis. I have a closed environment, but didn't think that detecting a virtual environment would be an issue for the bot. I will put my VMconverter onto a separate machine and clone from there.

Any tips on how to selectively get infected with Zeus?

Thanks,
Chele

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On Behalf Of Mayank.2.Bhatnagar
Sent: Wednesday, May 19, 2010 4:12 AM
To: honeypot honeypot
Subject: info reg Zeus bot detection and analysis

Hi everyone,

We are able to collect several samples of Zeus bot and there are many variants of the same.
However when we try to analyse it in our sandbox and closed environment, we are not able to get any activity.
There are several reports available, which are for same md5sum sample but still after much of analysis and triggering attempts, either the malicious sample dosnt trigger or if it does, it doesn't show any network activity.

What could be the reason? Where is the catch?? We have referred Zeus tracker sites (https://zeustracker.abuse.ch/blocklist.php), threatExpert reports but precisely what kind of analysis should be done and what environment created to analyse these setups.

We found that Vmware/Virtual setups may have been getting detected, but what abt a live sandbox environment. Why is the malicious exe not triggering there?? Where are we missing?

Anyone having pointers, suggestions...please suggest.
Thanks a lot,

Regards,
Mayank,
India


The information contained in this e-mail and any accompanying documents is intended for the sole use of the recipient to whom it is addressed, and may contain information that is privileged, confidential, and prohibited from disclosure under applicable law. If you are not the intended recipient, or authorized to receive this on behalf of the recipient, you are hereby notified that any review, use, disclosure, copying, or distribution is prohibited. If you are not the intended recipient(s), please contact the sender by e-mail and destroy all copies of the original message. Thank you.
Gary Derania
2010-05-19 19:04:17 UTC
Permalink
------Original Message------
From: "Michele Zoerb" <***@the41.com>
To: "Mayank.2.Bhatnagar" <***@ipolicynetworks.com>"honeypot honeypot" <***@securityfocus.com>
Sent: Wed 2010-05-19 08:48
Subject: RE: info reg Zeus bot detection and analysis

Interesting thoughts as I am just starting the same type of project. I want to get infected by Zeus and perform some analysis. I have a closed environment, but didn't think that detecting a virtual environment would be an issue for the bot. I will put my VMconverter onto a separate machine and clone from there.

Any tips on how to selectively get infected with Zeus?

Thanks,
Chele

-----Original Message-----
From: ***@securityfocus.com [mailto:***@securityfocus.com] On Behalf Of Mayank.2.Bhatnagar
Sent: Wednesday, May 19, 2010 4:12 AM
To: honeypot honeypot
Subject: info reg Zeus bot detection and analysis

Hi everyone,

We are able to collect several samples of Zeus bot and there are many variants of the same.
However when we try to analyse it in our sandbox and closed environment, we are not able to get any activity.
There are several reports available, which are for same md5sum sample but still after much of analysis and triggering attempts, either the malicious sample dosnt trigger or if it does, it doesn't show any network activity.

What could be the reason? Where is the catch?? We have referred Zeus tracker sites (https://zeustracker.abuse.ch/blocklist.php), threatExpert reports but precisely what kind of analysis should be done and what environment created to analyse these setups.

We found that Vmware/Virtual setups may have been getting detected, but what abt a live sandbox environment. Why is the malicious exe not triggering there?? Where are we missing?

Anyone having pointers, suggestions...please suggest.
Thanks a lot,

Regards,
Mayank,
India
Loading...