Here is the report of the third and final day of the SSTIC 2014 edition.<\/p>\n
THE social event<\/em> Having been through it myself, this report is a little lighter \ud83d\ude42<\/p>\n Introducing FuzzWin, a tool for instrumenting binaries (intercepting system calls, instructions, etc.).<\/p>\n <\/p>\n Introducing Python-pack, a packer that makes Python 2.7 code unreadable (permutation of the instruction set, addition of new opcodes, encryption of constant strings, transformation of if statements into while loops, automatic translation into pseudo-functional code, etc.).<\/p>\n <\/p>\n Introducing pTra (Python TRace Analyser), a tool that facilitates the understanding of a DRM algorithm (constant detection to identify cryptographic algorithms, input\/output analysis, data slicing, etc.).<\/p>\n <\/p>\n Victor Vuillard works at EDF in the nuclear sector. He presented the specific characteristics of his field compared to more "conventional" environments. Mindsets differ: there is a strong focus on safety in the nuclear sector, facilitating the implementation of certain security policies. There are also similarities between the nuclear sector and cybersecurity: concepts of defense in depth, preventative measures, monitoring, and response.<\/p>\n <\/p>\n The DRS algorithm used by VMware to migrate virtual machines (VMs) has been studied, and an attack has been demonstrated. By abusing the resources consumed by one or more VMs, it is possible to force the migration of that VM(s). This allows for the compromise of resources across an entire cluster (permanent VM migration).<\/p>\n <\/p>\n Starting from the observation that there is no equivalent to ProcessExplorer or ProcessHacker for RPCs, Jean-Marie Borello, J\u00e9r\u00e9my Bou\u00e9tard, Julien Boutet and Yoanne Girardin developed a tool to decompile RPCs: Rpcview.<\/p>\n <\/p>\n Haka is a language for defining security rules and performing protocol dissection. It is designed to be modular and allows for the easy definition of dissectors and filtering rules, as well as the modification or injection of network flows.<\/p>\n <\/p>\n Presentation of the new features added to Miasm since SSTIC 2012 through a demonstration (carried out at a particularly fast pace!).<\/p>","protected":false},"excerpt":{"rendered":" Here is the report of the third and final day of the 2014 SSTIC conference. The [\u2026]<\/p>","protected":false},"author":13,"featured_media":262,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[65],"class_list":["post-228072","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veille-securite","tag-sstic"],"yoast_head":"\n\u00ab"Development of an intermediate representation for concolic execution and data marking under Windows" \u2013 S\u00e9bastien Lecomte<\/h1>\n
\u00ab"Python Code Obfuscation: Improving Existing Techniques" \u2013 Ninon Eyrolles & Serge Guelton<\/h1>\n
\u00ab"DRM Deobfuscation via Side Attacks" \u2013 Camille Mougey & Francis Gabriel<\/h1>\n
\u00abExample of strengthening the security of a critical infrastructure operator\u00bb \u2013 Victor Vuillard<\/h1>\n
Short presentation: "Securing dynamic resource management in the cloud: taking control of triggering automatic virtual machine migrations" \u2013 Haiming Zheng, Jalel Ben-Othman, Kahina Lazri, and Sylvie Laniepce<\/h1>\n
Short presentation: "RpcView: a tool for exploring and decompiling MS RPC" \u2013 Jean-Marie Borello, J\u00e9r\u00e9my Bou\u00e9tard, Julien Boutet, and Yoanne Girardin<\/h1>\n
Short presentation: "Haka: a network and security-oriented language" \u2013 Kevin Denis, Mehdi Talbi, Paul Fariello, and Pierre Sylvain Desse<\/h1>\n
\u00abMiasm Tutorial\u00bb \u2013 Fabrice Desclaux<\/h1>\n