Utilizing Popular Websites for Malicious Purposes

Architecture and Background

Utilizing Popular Websites for Malicious Purposes Using RDI DANIEL CHECHIK SECURITY RESEARCHER, TRUSTWAVE SPIDERLABS ANAT (FOX) DAVIDI SECURITY RESEARCHER, TRUSTWAVE SPIDERLABS Reflected DOM Injection is a new attack vector that will be unveiled for the first time in our talk! We will explain the technique and show a live demo where we use it to hide malicious code within popular and trusted websites. Daniel Chechik is a veteran security researcher at Trustwave's SpiderLabs.

Vulnerability Analysis

Among other things, he specializes in malware analysis, web exploits detection, Trojan and botnet detection and neutralizing and defining security requirements for the Secure Web Gateway product. Prior to that, Daniel served in a technological unit as a security specialist in the IDF. During the service, Daniel specialized in CheckPoint Firewall equipment, AntiVirus products and other IT security products.

Exploitation and Demonstrations

Daniel, among other things, has spoken at the RSA conference, holds CEH and CCSE certificates and has a patent pending for 'Detecting Malware Communication on an Infected Computing Device'. Anat (Fox) Davidi is a security researcher at Trustwave's SpiderLabs. Her role includes vulnerability analysis, malware analysis and developing detection logic for the Secure Web Gateway product.

Remediation and Defensive Strategies

Prior to that, Anat worked as a security consultant providing security reviews and penetration tests for organizations in various business sectors, ranging from banks and insurance companies to hi-tech corporations. Amongst other things, Anat has spoken at the RSA conference. Materials: