Guus Bosman

I attended two big workshops in DC this week: the ironically named "LEET" and "WOOT" workshops, organized by USENIX.

LEET: Large-Scale Exploits and Emergent Threats
LEET stands for Large-Scale Exploits and Emergent Threats and included 13 presentations on a broad range of talks, from DDoS to spam to phishing. I particularly enjoyed these three talks:

- Funny analysis of what low-end DDoS services ("booters") are typically used for (50% of the customers are gamers who want to bring down their enemies, typically in residential addresses). -- https://www.usenix.org/system/files/conference/leet13/leet13-paper_karam...
- These guys tried to find out which Botnet sinks are out there (and who is creating them). Sort of "hack the counter-hackers". -- https://www.usenix.org/system/files/conference/leet13/leet13-paper_rahba...
- Insight from a security researcher who specializes in DDoS tools on recent developments. -- https://www.usenix.org/conference/leet13/understanding-emerging-threat-d...

WOOT: Workshop on Offensive Technologies
The WOOT workshops on Tuesday were focused on offensive technologies. The emphasis at USENIX is more academic than at conferences like BlackHat or DEFCON and less on getting publicity which is nice. Still, there were some pretty scary results.

Here are my favorites:

- Very cool demo of a new DNS bind flaw against Chrome (overflowing the browser's 100-entry cache used for the defensive DNS pinning) - https://www.usenix.org/conference/woot13/firedrill-interactive-dns-rebin...
- Solid presentation on how the researchers looked for (and found) "sign out" flaws by truncating TLS sessions. Affects GMail and Hotmail, among other things, and a distributed voting tool. Shows you that even if the theoretical framework is secure, the implementation might have flaws. -- https://www.usenix.org/conference/woot13/truncating-tls-connections-viol...
- How to hack the ELF loader into doing calculations. Totally useless but very cool. -- https://www.usenix.org/conference/woot13/%E2%80%9Cweird-machines%E2%80%9...

These workshops were very interesting, and I'm currently attending the main part of the event: 3 more days of presentations. This conference has a relative large amount of downtime which is nice since it allows you to meet people.