Northeast Ohio Information Security Forum

—< NORTHEAST OHIO INFORMATION SECURITY FORUM MEETING ---< Wednesday June 15, 2010 ---< 6:30 PM - 8:00 PM ---< Pizza and social start 6:00 PM ---< Location: Park Center Plaza #1, 6100 Oak Tree Blvd, off Rockside Road, Independence, Ohio ---< Open to everyone and free as always The Northeast Ohio Information Security Forum will hold our monthly meeting at the above date and time. It will be held in the lower level of the Park Center Plaza #1 building (in the large room on lower level) off of Rockside Road in Independence. I've included links to maps and directions in this email. Talks planned (abstracts and bios at bottom of this email)... Ten Ways to Fail at Information Security by Chris Clymer by Chris Clymer, Senior Security Consulant SecureState Building a completely evasive backdoor without any detection rules by Dave Kennedy "ReL1K", Dude that breaks things Don't forget to come early, starting at 6:00 PM, for pizza and pop courtesy of NEOISF (http://www.neoisf.com/training). Another great meeting from NEO Info Sec Forum - we hope to see you there! -- NEOISF Board -- ---------------------------------------------------------------------------------- [Location] Park Center Plaza 1 6100 Oak Tree Blvd Google maps link: TinyURL link http://tinyurl.com/neoisfmtg [Directions] 1. I-77 2. Rockside Road exit 3. West on Rockside Road 4. 2nd light go South onto Oak Tree Blvd 5. Pull into the 3rd driveway on the right 6. Go to lower level Signs will be posted on the building. ---------------------------------------------------------------------------------- -- Follow us on Twitter: http://twitter.com/neoisf Our website: http://www.neoisf.org ============================================================ You are receiving this because you are on the Northeast Ohio Information Security Forum mailing list. To unsubscribe or edit your subscription send an email to board@neoisf.org ============================================================ - – - – - – - – - – - TALK ABSTRACT: Since leaving corporate life to become a consultant 12 months ago I’ve had the opportunity to observe and assess security programs across a wide array of companies. Hospitals, banks, utilities, law offices and grocery stores…everyone does security a little bit differently. One common theme has been that there is no one “right” way to run an effective security program. There are however so many spectacularly different ways to do security wrong! In this presentation I will highlight ten different ways that I’ve seen security NOT work, and which likely WON’T work for anyone, anywhere. SPEAKER BIO: Chris Clymer is a senior security consultant with the Advisory Services practice at SecureState, a Cleveland-based security consultancy. Chris is a co-host of the Security Justice podcast, is an organizer of Security Bsides Cleveland, a founding member of the Cleveland TOOOL chapter, and of course a board member of the Northeast Ohio Information Security Forum. He specializes in taking the opposite side of any security argument 😉 Building a completely evasive backdoor without any detection rules David Kennedy TALK ABSTRACT: We all know Anti-Virus is failing us but what about other technologies? We have HIPS, behavioral, heuristics, IPS/IDS and others. This talk will be covering a recent interactive backdoor that I wrote for the Social-Engineer Toolkit (SET) that acts polymorphic in nature per each instance and leverages 256AES encryption with a randomized cipher key exchange per connection. Best part is it doesn't get detected by anything out there and circumvents pretty much every protection mechanism I've seen. We'll go into how it was built, the overall structure and how you can build your own very easily leveraging Python. SPEAKER BIO: David Kennedy (ReL1K) is a security ninja and Director of Information Security for a Fortune 1000. Dave is on the Back|Track and Exploit-Database development team and a core member of the Social-Engineer podcast and framework. David continues to contribute to a variety of open-source projects. David had the privilege in speaking at some of the nations largest conferences on a number of occasions including BlackHat, Defcon and Shmoocon. David is the creator of the Social-Engineer Toolkit (SET), Fast-Track, modules/attacks for Metasploit, and has released a number of public exploits. David heavily co-authored the Metasploit Unleashed course available online and has a number of security related white-papers in the field of exploitation. David has a book soon to be released in July from NoStarch Press, “Metasploit: A Penetration Testers Guide”. David is one of the founders of DerbyCon, a hacker con located in Louisville, Kentucky. Lastly, David worked for three letter agencies during his U.S Marine Corp career in the intelligence field specializing in red teaming and computer forensics.