As previously mentioned on this blog, I was going to attend the Virus Bulletin 2008 conference as just a delegate, for the very first time; I usually attend as a speaker. The conference was held at the Westin Ottawa, in Ottawa, Canada [surprisingly ;-)] between the 1st and 3rd of October.
However, I ended up being a speaker again, which I don't mind, but I was actually looking forward to having a more relaxed conference than I usually do, but that's life!
This posting is a quick review of the conference:
Day 1 - Wednesday 1st October 2008The first day of the conference started at 10:30 with Helen Martin’s opening address, this was followed at 11:00 by the Keynote address "
The AV industry: Quo Vadis?" presented by Alex Eckelberry of Sunbelt Software. This was a very interesting speech and contained lots of useful information, as well as a general overview of what the bad guys [and girls] are up to, as well as what the good guys [and girls] are up to.
You can find a recording of it here, along with the slides:
http://sunbeltblog.blogspot.com/2008/10/virus-bulletin-2008-keynote-address.htmlThe final session on the Technical Stream before lunch was also interesting, a presentation by Morton Swimmer [who used to work for IBM] entitled:
- Towards integrated malware defence
It was a good presentation, however as Morton had moved to TREND just before the conference he no longer had access to all his data, which was a shame, as it seems to have been rather an effective solution.
Then it was time for lunch.
After lunch, the conference continued in its normal two stream mode; Corporate stream and Technical steam. Normally I spend most of the conference in the technical stream, and on this first day that was pretty much the case. I spent the whole afternoon in the Technical Stream.
The first two presentation after lunch were:
- Your computer is now stoned (...again!). The rise of MBR rootkit - Kimmo Kasslin, F-Secure
- When the hammer falls - effects of successful widespread disinfection on malware development and direction - Matt McCormack, Microsoft
The presentation given by Kimmo was esepcially interesting as it covered the rebirth of MBR infectors; something that had almost died out when Windows NT, 2000 and XP came along [yes there have been some MBR infectors for those, but not many, and not with stealth capability].
Then we had a short break for Tea and coffee before the attending the final pair of presentations on the technical stream. These were:
- Applying user-mode memory scanning on Windows NT - Eric Uday Kumar, Authentium
- Packer visualisation: a fast entropy scanning algorithm that preserves local detail - Li Sun, RMIT University
I decided to sit in on the vendor presentation after the days main proceedings, this was given by my good friend David Harley, from Eset.
Later we had the "Welcome drinks reception" which is a nice ice-breaker, especially for those that have not been to a VB Conference before as it is very informal and relaxed.
This was staged with a couple of Ice Hockey players; for those that wanted pictures, as well as a bit of fun from Ken Bechtel, who's hat did the rounds and photos were taken of those that ended up wearing it, including me. If you've ever met Ken, you'll know which hat I mean as he is rarely seen without it.
Day 2 - Thursday 2nd October 2008Day two started early for me as I was informed when I arrived that I might be needed to present [I was the emergency reserve speaker;
"in case of a missing speaker, break glass and grab Martin ;-)"], as one of the speakers for the morning session on the Technical Stream was unaccounted for; he never did turn up.
So, I had to go back to my hotel [I wasn't staying at the Westin], get changed, grab my laptop and get back to the conference by the morning tea break to check that my laptop worked fine with the projector, it did.
This meant that I effectively missed the first two presentations I had planned to attend, oh well.
To complicate matters, I was also supposed to be chairing the three sessions on the Corporate Stream between the morning tea break and lunch; which I couldn't now do, as I was presenting in the other stream at the same time. Luckily, my old friend from Nortel, John Morris, stepped into the void as the new session chair.
So after the morning tea-break I was back in the Technical Stream for the next three presentations, these were:
- The robustness of new email identification standards - Reza Rajabiun, COMDOM Software and York University
- Coordinated distributions method for tracking botnets sending out spam - Andrey Bakhmutov, Kaspersky Lab
- Malware forenscis: detecting the unknown - Martin Overton, IBM ISS
The presentation given by Andrey was extremely good, some excellent research which was well presented and explained. This led to a flurry of questions.
It seemed rather surreal when I gave my presentation, as it was designed for an audience on the Corporate Stream; so as an old English saying goes "
it was like teaching my grandmother how to suck eggs". In other words the presentation was an overview of forensic techniques and tools for finding and analysing malware [known or new] on an infected system.
This was presented on the Technical Stream to about 70 or more of the
worlds best malware researchers, hence my use of the saying.
The presentation was actually based on my EICAR 2008 paper which I was unable to present at the EICAR conference, ironically due to the fact I was tied up in a malware forensics case.
Then it was time for Lunch, not only to refuel with food, but also to discuss and digest what we'd seen so far.
I received some nice feedback from a few of those that sat in, and no awkward questions. In fact one of the guys who were running the audio-visual side of the conference said he thoroughly enjoyed my presentation and found it most useful and enlightening.
After lunch, once more I decided to sit in on the Technical Stream until the tea/coffee break, at least. The next four presentations, all last minute ones limited to 20 minutes each, were:
- VB testing - present status, future plans, John Hawes, Virus Bulletin
- Race to zero with online scanners, Boris Lau, Sophos
- There is (some) honour among South American authors of infostealer trojans!, Pedro Bueno, McAfee
- Apple iPhone programming with SDK, Marius van Oers, McAfee
This year these short technical presentation worked rather well, although it was hard for some of the presenters to keep to the 20 minute slot limit, yes, you know who you are.
Then it was time for another caffeine break ;-)
After the tea/coffee break I moved to the Corporate Stream as I was chairing the last two presentations on that stream, these were:
- The NorTel Mailer: effective open-source spam filtering for enterprises - Chris Lewis, Nortel
- SCADA security - who is really in control of our control systems? - Peter Allor, IBM
Both of these were very interesting presentations and it was a shame that so few delegates had decided to sit in on them.
Before the day was over we also had our first panel session, this was:
- The state of anti-malware testing
Later we had the "pre-dinner drinks and the Gala dinner and entertainment".
As always the food was excellent and the entertainment this year differed quite a bit, it was a quiz, which was fun but took longer than expected to complete. As one delegate was heard to say "
we have travelled 3,500 miles for a pub quiz!". Personally, I enjoyed it, it just needed to be shorter.
Day 3 - Friday 3rd October 2008The final day of the conference had arrived, I'm still not sure where the first two days had gone, but they sure went quickly!
As we started slightly later on the last day, to allow for those that had partied hard until the small-hours to get some sleep, and maybe quite a bit of black coffee, there was only a single presentation before the first coffee/tea break of the day. The one I decided to attend was on the Corporate Stream, again:
- Understanding and teaching bots and botnets - Randy Abrams, ESET
This presentation covered a topic that I had presented on back at VB2005 in Dublin, but from a high-level perspective and more focussed on how to educate staff about these threats via using robot vacum cleaners known as Roombas.
As usual Randy was both informative and entertaining.
So, another quick tea and coffee break and then back to the Technical Stream until lunch, these were the next presentations I sat in on:
- Automatic rules-based binary analysis with IDA Pro and CLIPS - Ryan Hicks, AVG
- Rebuilding testing for the future - Igor Muttik
- Samples.malware.org: sample sharing for the next decade? - Richard Ford, Florida Institute of Technology
All of these were very good and interesting talks and all generated lots of discussion and questions.
Then it was time for the final lunch of the conference, but before that, all the speakers had to get together for the traditional "Speakers Photo". As usual, much hilarity was had by all. However, I think I can honestly say that this years photo was the quickest ever as it took less than 5 minutes to organise all the speakers and take a number of photos.
After lunch I spent the first part of the afternoon on the Corporate Stream.These were the presentations I sat in on:
- Where do your users want to go today and can you stop them? - Bruce Hughes, AVG
- The name of the dose: does malware naming still matter? - Pierre-Marc Bureau and David Harley, ESET
Both of these were interesting and prompted a number of questions from the audience.
Then it was time for the final refreshments break. Yes, it was the very last VB2008 Tea and coffee break of the whole conference.
The final presentations of the day, and the conference, were straight after the break and I decided that I'd sit in on the last one on the Technical Stream again. This was:
- Darwin inside the machines: malware evolution and the consequences for computer security - Peter Ször, Symantec
Dimitris Iliopoulos, Keck Graduate Institute of Applied Life Science
This was a very interesting presentation, basically saying that malcode could in theory evolve following Darwinian principles. Not sure that we will see such malware any time soon, as there are a number of things that need to happen first.
Although all the conference papers presentations had finished there was a very interesting and lively panel discussion on:
- Security in banking forum
Finally it was time for the Conference closing session, once more led by Helen Martin, the editor of Virus Bulletin.
It included the usual selection of scenic photos as well as general candid shots taken during the conference, including some 'comic' ones. This year it seemed to be another case of "
I'm Sparticus", as a lot of people seemed to be wearing Ken Bechtel's hat, including me, and no it wasn't him in varying disguises either!
My final impressions of VB2008 are mixed; I enjoyed it, but I [and others who I chatted with] seem to think it may have lost its edge. Is this a case of becoming too commercialised or due to a lack of the usual swathe of quality research papers [which may be due to security companies cutting research budgets], or is it just a sign of the times as the marketplace has matured and that threats have now converged?
If you attended VB2008 and have an opinion, then please let me know your thoughts, thanks.
Copies of the slides used by the speakers during the presentations can be found here:
http://www.virusbtn.com/conference/vb2008/slides The full agenda for the conference can be found here:
http://www.virusbtn.com/conference/vb2008/programme/indexFinally, if you are really curious and want something to put you to sleep, then you can also find a selection of scenic photos I took whilst in Ottawa, here:
http://picasaweb.google.com/overtonm/OttawaCanada2008?authkey=SEeottY873o#Well, that's another VB conference covered, I'm already looking forward to the possibility of attending next year, where it will be in Geneva, Switzerland at the end of September 2009. Right, now I need to find some ideas for a few abstracts to submit....any suggestions?
Labels: all, hoax, life, malware, on-line-games, papers, scams, social-engineering, social-networks, spam, stats, tools
