Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1

Posted by   Martijn Grooten on   Aug 3, 2017

With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also often look back at past conference presentations, not just because we are proud to have had them presented at our conference, but because their content is still very relevant today.

In a two-part blog post, I look back at ten conference papers from the last ten conferences (not by coincidence covering my own tenure at VB) that I often think back of, and that remain relevant.

 

The strange case of Julie Amero

Early in 2007, Julie Amero, a substitute teacher from Connecticut, was tried and convicted of four counts of risk of injury to a minor, as she was believed to have been browsing pornography while teaching a class of 12-year-olds. However, she wasn't: her computer had been infected with spyware, which led to the adult content being shown on her machine in the same room as her students. Appalled at the injustice, a group of industry experts joined forces to assist in Ms Amero's case and overturn the conviction; details of the case and the forensic investigations that provided the all-important data that ultimately proved Ms Amero's innocence were presented in a VB2017 paper by one of those industry experts, Alex Shipp.

VB2007 was my first Virus Bulletin conference, and as my role at the company back then wasn't directly related to security, I mostly worked behind the scenes and only saw a few talks — of which, Alex's was my first. The impression it gave me, and which has been confirmed many times since then, was that these people really cared about making the world more secure, and it has never left me.

 

The NorTel Mailer: effective open-source spam filtering for enterprises

Spam, as a book I recently read explained, started as a nuisance within a community and the efforts to fight it have deep roots in (open-source) community tools and projects. At his then employer Nortel, Chris Lewis had used such tools to build an impressive framework to detect and stop spam, details of which he presented at VB2008 in Ottawa.

The flexibility these tools gave him may not be necessary for your average organization, but it was exactly what I was looking for for the spam-filter test I was building at the time. Many ideas from Chris's presentation are still evident in how this test is built.

 

The Partnerka — what is it, and why should you care?

With, according to Google, 37 academic citations, Dmitry Samosseiko's VB2009 paper on the 'Partnerka' is definitely one of the most influential in VB's history. The affiliate networks described in the paper have since become well known among those researching cybercrime, but at the time the paper (pdf) was presented in Geneva, the industry had barely moved beyond the mindset of believing the adversary to be a child operating from their parents' basement. The idea that there were complex business structures behind most cybercrime opened the eyes of many and the paper provided the research community with the first thorough research into such structures.

glavmed.png


An indepth look into Stuxnet

It has been said that the summer of 2010 was when the security industry lost its innocence: it was then that Stuxnet was discovered. Whether or not one sees it as dramatically as this, Stuxnet was certainly a defining moment in the history of computer security (I highly recommend Kim Zetter's book on it), and we were lucky that its discovery coincided with the call for last-minute papers for the conference.

Such was the importance of the discovery that at VB2010 in Vancouver there were not one but two last-minute presentations on Stuxnet — with press flying in from around the world to attend. Of the two presentations, it was that of Liam O'Murchu that was most memorable for me: Liam explained how Stuxnet modified the PLC in the nuclear plant it had targeted to make the centrifuges spin faster. To demonstrate the concept behind this, he built a simple device that inflated a balloon and then wrote a piece of code that modified the PLC on the device to prevent the inflation from stopping, thus resulting in a big bang — and a seriously impressed audience.

 

Modern bootkit trends: bypassing kernel-mode signing policy

Together with Sergey Bratus, Eugene Rodionov and Alex Matrosov are the authors of a book on rootkits and bootkits. Eugene and Alex's expertise in this subject has long been established, for instance through a number of VB conference talks, the first of which they delivered at VB2011 in Barcelona, when they looked at various cases of bootkits that managed to bypass various security enhancements introduced in x64-bit Windows.

Next Thursday I will complete my list, taking a look back at another five memorable papers from VB conferences past.

In the meantime, if this has whet your appetite, check out the programme for this year's conference, and book your ticket for what promises to be another memorable event!

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

Nominations opened for sixth Péter Szőr Award

Virus Bulletin is seeking nominations for the sixth annual Péter Szőr Award.

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various…

Book your VB2019 ticket now for a chance to win a ticket for BSides London

Virus Bulletin is proud to sponsor this year's BSides London conference, which will take place next week, and we have a number of tickets to give away.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.