Embedded devices have for a long time been proficient in infiltrating many spheres of application, both at the home and at the office.

The vendors' motto always stays the same: "Vendor lock-in" and "Security through obscurity", and we find these principles chosen by major brands and minor companies alike.

The simplicity of implemeting those measures, and the strong confidence in posessing the know-how are the key factors for the vendors to select them.

But from the attacker's viewpoint, these ill-designed security measures can be defeated much easier than proven, industry-standard technologies.

To accomplish this, one simply needs to have the basic revese-engineering skills and be aware of the features of a chosen hardware platform.

The talk will cover some tips and tricks of embedded MIPS reverse engineering. А case study featuring DrayTek SOHO-class router series will illustrate a disclosure of a master password for more than 30 router models widely deployed over Australia, UK and Germany.

About a higher education problem in Russia, including in the field of information security, everyone knows, this question constantly rises at many theoretical conferences, and decisions which remain only in the theory are made. One of higher education problems is that in many high schools which prepare experts in information security, the teachers having practical experience in the given field are not enough (and even there are no at all). The aim of the given report isn't working out the higher-level concept of a education development in the field of IS, there is only an offer to raise this question at conference among a great number of practising experts and to take out the vision of the decision on the given problem for general discussion.

Implementation of a printing interception on Windows isn’t a trivial task because there are no built-in programming interfaces designed for this purpose. Most of well-known methods have different kinds of difficulties both in implementation and usage. The given example of monitoring method can be relatively easily implemented due to the fact that it is a simplified and generalized variation of well-known methods.

Windows GDI is pretty noticeable for implementing printing monitoring because it manages both drawing everything we can see on a screen of monitor and printing process as well. Most of times we print stuff that we see on a screen and this fact allows this method to be considered as effective.

In this paper we are going to reveal some of little secrets of GDI, spooler and also some basic principles of developing information monitoring systems under Windows OS.

Providing security of information systems from the penetration tester's and vulnerability researcher's point of view is a complicated task, especially in the case of black-box testing with a very few initial knowledge of the system internals. In this paper we will dive into the problems of network traffic tracing for the purposes of debugging and reverse engineering of programs and network interaction. We will show how to gain advantages of both a code debugger and a protocol analyzer under Windows using well-known methods of protocol debugging as well as new approaches, based on recent improvements in Windows networking subsystem.

There are many vulnerabilities that one would rather ignore than deal with, such as low-risk vulnerabilities, vulnerabilities that are hard to exploit, vulnerabilities turned into hands-on experience, and others. However, vulnerabilities will stay vulnerabilities; one never knows when they will be exploited. In the report I will tell how an aggregate of trivial setting and encryption errors in a popular Denwer build can be exploited to gain a full access to the system simply by tricking a user into following a link. The attack is triggered by a trivial XSS on a local web server, whose CVSS Score is so low that makes it absolutely unremarkable. Besides, the report is concerned with techniques that allow creation of effective client-side exploits to be used in attacks against corporate systems via XSS/CSRF/DNS Pinning. Such attacks include bypassing XSS filters of browsers, web reverse-shell that anti-viruses do not detect and gaining full access to OS commands when non-standard web server configurations are used.

What is DBI? What is DBI for? What kinds of DBI exist? Advantages and disadvantages of the given technology and how it is possible to use it for information security purposes.
The most popular frameworks will be considered and compared:

• PIN
• Valgrind
• DynamoRIO
• DynInst
Information for quick and successful start of working with DBI will be presented at the speech.

In October of this year, the sensational story of Stuxnet worm got a new stage of development. Win32/Duqu - a previously unknown malware - was discovered, which is based on the source code of Stuxnet. In this presentation we will be speaking about interesting findings revealed during analysis of Win32/Duqu.

In the report development and evolution of Drive-By-Download network attack will be presented, which affected on the well-known domains in the .RU zone, during several months (from July to November 2011), since the appearance and testing of vulnerable software delivery technologies and up to the moment when web sites with attendance of more than 200 000 users per day were used for the distribution of different types of vulnerable software.

What problems (technical and procedural) occur when investigators perform a forensic examination of digital evidence connected to an incident in remote banking system? How to solve them? The speaker will describe his point of view on specified questions together with trends of development of banking malware and fraud techniques from a forensic perspective.