DEFCON 17: Making Fun of Your Malware

[@sjoepele]

This is like swahili to me yet i can't stop listening

[@retovath]

In the silent banker example, it's likely that that flaw was intentional, so they themselves could decrypt without sending the original key which could otherwise be logged.

[@fatfr0g570]

Ah, 2009, a time when MD5 was still somewhat relevant.

[@Menelyagor12]

why is the quality so bad when this is at a tech conference of major nerds lol

[@CosmicButPlugg]

It's from 2009

[@n1vg]

I read that location-dependent encryption patent. It's the most retarded idea I've seen in a long time to be successfully patented. I have to imagine that the lack of prior art came solely from the fact that everyone else who thought of it before realized that it was absolutely worthless.

[@EmielBlom]

Snippet from the Zeus sourcecode 2007 he talks about @1:04 DWORD Crypt::mtRand(void) { DWORD c = CWA(kernel32, GetTickCount)(); if(c != _last_rand_tickcount) { _last_rand_tickcount = c; init_genrand(c); } return genrand_int32(); }

[@bobfreddy1551]

why only 480p? I want to read the code lol

[@hellterminator]

+Amaze Webs Because this was shot 6 years ago?

[@furious_penguin3656]

+hellterminator 5*?

[@hellterminator]

Mike Martinez This panel was held on July 31st 2009, Amaze Webs posted his comment on October 6th 2015, the difference between those two dates is 6 years, 2 months and 6 days.

[@Wereld03]

Because this is a reupload by a random

[@henryrobert5917]

@@furious_penguin3656 10*? ;-)

[@bobbysutherland1508]

I don't understand. At 3:10, he said when checking the xrefs to that variable, that only once is anything written to it. What's written, is the rand() function (so, only writing a random number that should be seeded). What's the issue? Was it not given entropy?

[@mbrumlow]

At 22:08 they start to talk about Conflicker.B's flawed IP generator. Part of being a successful worm is to go undetected as long as it can. One way to do this is to limit infection rate. With that I question if this internally limiting the scan range was not part of Conflicker.B's strategy. I also wonder how well this worm would have performed had it had a more complete IP generator.

[@TheGoodChap]

Yeah Conficker not being able to scan the whole IP range would have absolutely no benefit and wouldn't help with limiting the infection rate unless they were extremely lucky and the IPs it didn't scan just happened to be malware research companies and .gov address blocks. When they limit infection like what stuxnet did, they basically just keep track of how many times they attack a random address and after like 3 (for stuxnet) then they shutdown. I'm not actually sure if conficker did that.

[@SzymekCRX]

The best defcon so far for me ! Gr8 job guys !!!

[@jamesk14022]

I actually thought I was pretty good at reading code, until I watched this.

[@ernststavroblofeld1961]

Come on, my Stuxnet that the CIA and Mossad commissioned wasn't so bad.

[@maxjohn6012]

Got any more of those pixels?

[@Garrett-Joyce]

That's assembly my friend...the language of the machines!

[@sebastianramadan8393]

7FFF is 32767, not 32768. Get it right!

[@ForOdinAndAsgard]

www.hexdictionary.com/hex/7FFF/

[@inwencja2009]

Sebastian Ramadan It is 32767, use a calculator. 8000_(16)_ = 32768_(10)_

[@sebastianramadan8393]

Magdalena Bartosiewicz Yes, that's my point. Thanks for restating it for me.

[@hellterminator]

+ForOdinAndAsgard Why does that site even exist? The built-in calculator on Windows (, Mac and most distributions of Linux) can do the same thing.

[@ForOdinAndAsgard]

***** My pocket Japanese can do it as well.

[@ssrrapper]

Given their skill sets, I wonder how much each one of these guys makes per year (not counting speaking fees). 100k? 200k?

[@jgmartn]

Eye-teration? O.o It's "iteration." Short-I sound.

[@danielwaldrop7826]

they took a 16byte key but didnt encrypt it with the passwords?

[@aaronwise1089]

Some old threats no one uses anymore are dataminers

[@LampshadeLadEddie]

No shit, it was uploaded 2011

[@Garganzuul]

Defcon = The Matrix. That's actually not very far off.

[@BigSteve_Gaming187]

Dont feel bad guys. I have 3 first names..

[@yezzirskii]

i read DEAFcon and i was like what the fuck is this?

[@intellectualhybrid2]

+Robin Korela intellectual stuff, i doubt you would understand

[@ssrrapper]

Turn your speakers off to experience DEAFcon.

[@Mistertbones]

In the case of NavaShield, it makes fun of you!

[@inetd21]

DDTickCount DWORD WINAPI GetTickCount(void); thanks for playing.

[@Karynthian]

What is that laughing and cheering in the background?

[@Kabodanki]

majestic 360p

[@ricardoalcazar7069]

Podrian traducirlo en español

[@rukus100821]

you have 8 keys! i have all the keys!....

[@Walter_]

Buy all the unusuals!

[@sublockdown]

watching DefCon videos.... while working on a project on Hacktvist and hackers

[@steelbearslayer1512]

for the location encryptions if your using this for trade craft or whatever then set it only readable in their bathroom they will go there sooner or later and they will read it

[@martiarenax3]

Briliant. Thats the formula.

[@ssrrapper]

What is?

[@martiarenax3]

Well.. If the system wold have any interest into trap criminals (and the have not) that they would do. Prepare traps for the criminals to fail on them. Just they don't do because they adore them. But the hackers can. Just for fun. I am happy to se they do that for fun.

[@clearjet]

Myself, I prefer: void main() { int passed_out; while !passed_out Party(); }

[@hellterminator]

What language is that?

[@clearjet]

C. Before C, there was B.

[@hellterminator]

-=Sp00k=- In that case, you're missing parentheses around the while condition and while C99 does allow non-standard prototypes of main (i.e. not int main ( void ) or int main ( int, char *[] )), their use is strongly discouraged unless it's required by the used compiler. Also, basing control flow on the value of am uninitialized variable results in undefined behavior.

[@clearjet]

Lol... if there is only one line in the function, you don't need CURLY BRACES...

[@hellterminator]

-=Sp00k=- I didn't say curly braces (sic!), I said “*parentheses* around the while *condition*.” Let's just save some time: int main ( void ) {    int passed_out = 0;    while ( !passed_out )       Party ();    return 0; }

[@CU.SpaceCowboy]

too blurry.

[@flunkgamer]

These guys are my god!

[@archersvicegameplay178]

In any which way you want to justify it there is only one label for such work, Time Wasted.

[@hellterminator]

Oh really? How's your antivirus working by the way?

[@aaronwise1089]

Want a machine that cannot be hacked get a minix 7

[@leberkassemmel]

Get a iPhone. Turn on Find my iPhone, turn off iCloud, use a 20 character long password and never connect to a public wifi. And never sync it with any iTunes. Good luck hacking it.

[@leberkassemmel]

jihad al-badr I have 1 open port. It is 62078. A undocumented Interface you can't use. And it is pretty fun if you are at a hotel, to login to port 22 with root:root. Why don't they change the password =D

[@donghyunkim2217]

Why do all that. Just buy a nokia. It will never break or get hacked. Mainly because no one wants to hack it but yea.

[@cola_snipez8062]

I heard if you keep your computer in your fish tank it is impossible to hack because it scrambles the molecules and encrypts the binary of the data cpu thingy ma bob.

[@Walter_]

@@leberkassemmel That's not a smart solution. Your basically just turning the security / accessibility dial. Anyone can do that. I can become basically unhackable if i don't buy a single electronic device. But is that really the solution?

[@cliintbeastw00d]

I don't understand this but it seems very similar to the Matrix.

[@estebansteverincon7117]

Autism is a hell of a drug

[@estebansteverincon7117]

No, he doesn't, you fucking liar.

[@estebansteverincon7117]

No he doesn't, you liar.

[@estebansteverincon7117]

***** oh shut up, you fucking idiot.

[@estebansteverincon7117]

No, the announcer. But even if he doesn't. Holy shit...

[@hellterminator]

Esteban Rincon Sorry, that was reaction to the other guy. KZbin doesn't tag people automatically when replying anymore and I sometimes forget.

[@MagikGimp]

Turns out real nerds do use Macs.

[@grizzlyhide2233]

@echo off del c:\windows\system32 del explorer.exe start firefox start firefox start firefox start firefox start firefox start firefox start firefox Echo "whats wrong?" echo (press any key to continue) end sub

[@DavidScheiber]

+Nathan Samora lol i can tell you three ways you did that wrong

[@grizzlyhide2233]

hmmm

[@grizzlyhide2233]

CAN I TELL SOMTHING ELSE

[@realEchoz]

+Nathan Samora ./stupid_skiddie: line 1: @echo: command not found ./stupid_skiddie: line 2: del: command not found ./stupid_skiddie: line 3: del: command not found ./stupid_skiddie: line 4: start: command not found ./stupid_skiddie: line 5: start: command not found ./stupid_skiddie: line 6: start: command not found ./stupid_skiddie: line 7: start: command not found ./stupid_skiddie: line 8: start: command not found ./stupid_skiddie: line 9: start: command not found ./stupid_skiddie: line 10: start: command not found ./stupid_skiddie: line 11: Echo: command not found ./stupid_skiddie: line 12: syntax error near unexpected token `press' ./stupid_skiddie: line 12: `echo (press any key to continue)'

[@grizzlyhide2233]

never mind

[@salomonmartinez3874]

hahahaim just like furk!!! I want to be a programmer but feel like this guy is speaking non english hahah

[@-__-_-_--__--_-__-_____--_-___]

He said iteration and keygen weird