Polymorphic Shell Code API
K2 examines description from DEF CON 9 Speaker’s Page: Polymorphic shellcode API Polymorphism has been around for years in the form of virus attacks.
Summary
Architecture and Background
Description from DEF CON 9 Speaker’s Page: Polymorphic shellcode API Polymorphism has been around for years in the form of virus attacks.
Vulnerability Analysis
There is a wealth of information pertaining to this.
Exploitation and Demonstrations
This presentation will concern itself with the implementation of an API designed to place some black-box code (probably shellcode) within an encoded structure and deliver it against a number of Architectures (SPARC,HP,IA32,more soon).
Remediation and Defensive Strategies
This code has been tested thoroughly against a number of popular NIDS Sensors (ISS, snort, dragon, NFR, ), and has proven that as of yet, the code itself can NOT be detected at all. There are some possible methods of detection and that will be analyzed and future modifications to further evade these measures. K2 is a security consultant for a major multi-national company, personally located in Vancouver, Canada. Spare time spent mostly investigating OS/Network vulnerabilities and the exploitation there of :) Years of assembly experience and a well developed cross-platform knowledge base.
Related talks
Main Stage·1 hr 36 min
Barry Stiefel
Barry Stiefel explores nat for newbies and not so newbies at DEF CON 9, examining nat-traversal and practical defenses.
Main Stage·55 min
Ian Goldberg
Ian Goldberg explores arranging an anonymous rendezvous at DEF CON 9, examining nat-traversal and practical defenses.
Main Stage·55 min
Michael Wilson
Michael Wilson explores hacker doctrine in information warfare at DEF CON 9, examining nat-traversal and practical defenses.