Posted by Martijn Grooten on Aug 3, 2017
With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also often look back at past conference presentations, not just because we are proud to have had them presented at our conference, but because their content is still very relevant today.
In a two-part blog post, I look back at ten conference papers from the last ten conferences (not by coincidence covering my own tenure at VB) that I often think back of, and that remain relevant.
Early in 2007, Julie Amero, a substitute teacher from Connecticut, was tried and convicted of four counts of risk of injury to a minor, as she was believed to have been browsing pornography while teaching a class of 12-year-olds. However, she wasn't: her computer had been infected with spyware, which led to the adult content being shown on her machine in the same room as her students. Appalled at the injustice, a group of industry experts joined forces to assist in Ms Amero's case and overturn the conviction; details of the case and the forensic investigations that provided the all-important data that ultimately proved Ms Amero's innocence were presented in a VB2017 paper by one of those industry experts, Alex Shipp.
VB2007 was my first Virus Bulletin conference, and as my role at the company back then wasn't directly related to security, I mostly worked behind the scenes and only saw a few talks — of which, Alex's was my first. The impression it gave me, and which has been confirmed many times since then, was that these people really cared about making the world more secure, and it has never left me.
Spam, as a book I recently read explained, started as a nuisance within a community and the efforts to fight it have deep roots in (open-source) community tools and projects. At his then employer Nortel, Chris Lewis had used such tools to build an impressive framework to detect and stop spam, details of which he presented at VB2008 in Ottawa.
The flexibility these tools gave him may not be necessary for your average organization, but it was exactly what I was looking for for the spam-filter test I was building at the time. Many ideas from Chris's presentation are still evident in how this test is built.
With, according to Google, 37 academic citations, Dmitry Samosseiko's VB2009 paper on the 'Partnerka' is definitely one of the most influential in VB's history. The affiliate networks described in the paper have since become well known among those researching cybercrime, but at the time the paper (pdf) was presented in Geneva, the industry had barely moved beyond the mindset of believing the adversary to be a child operating from their parents' basement. The idea that there were complex business structures behind most cybercrime opened the eyes of many and the paper provided the research community with the first thorough research into such structures.
It has been said that the summer of 2010 was when the security industry lost its innocence: it was then that Stuxnet was discovered. Whether or not one sees it as dramatically as this, Stuxnet was certainly a defining moment in the history of computer security (I highly recommend Kim Zetter's book on it), and we were lucky that its discovery coincided with the call for last-minute papers for the conference.
Such was the importance of the discovery that at VB2010 in Vancouver there were not one but two last-minute presentations on Stuxnet — with press flying in from around the world to attend. Of the two presentations, it was that of Liam O'Murchu that was most memorable for me: Liam explained how Stuxnet modified the PLC in the nuclear plant it had targeted to make the centrifuges spin faster. To demonstrate the concept behind this, he built a simple device that inflated a balloon and then wrote a piece of code that modified the PLC on the device to prevent the inflation from stopping, thus resulting in a big bang — and a seriously impressed audience.
Together with Sergey Bratus, Eugene Rodionov and Alex Matrosov are the authors of a book on rootkits and bootkits. Eugene and Alex's expertise in this subject has long been established, for instance through a number of VB conference talks, the first of which they delivered at VB2011 in Barcelona, when they looked at various cases of bootkits that managed to bypass various security enhancements introduced in x64-bit Windows.
Next Thursday I will complete my list, taking a look back at another five memorable papers from VB conferences past.
In the meantime, if this has whet your appetite, check out the programme for this year's conference, and book your ticket for what promises to be another memorable event!
