Mitsugu Okatani, Joint Staff Office, J6, Japan Defense Agency
Change of the Meaning of a Threat and Technology...What has Occurred Now in Japan?

Darren Bilby
Low Down and Dirty: Anti-Forensic Rootkits

Paul Böhm
Taming Bugs: The Art and Science of Writing Secure Code

Kenneth Geers & Alexander Eisen
IPv6 World Update: Strategy & Tactics

Jeremiah Grossman
Hacking Intranet Websites from the Outside "JavaScript malware just got a lot more dangerous"

Yuji Hoshizawa
Increasingly-sophisticated Online Swindlers

Heikki Kortti
Input Attack Trees: Death of a Thousand Leaves

Dan Moniz
Six Degrees of XSSploitation

Joanna Rutkowska
Subverting Vista Kernel For Fun And Profit

Alex Stamos & Zane Lackey
Breaking AJAX Web Applications: Vulns 2.0 in Web 2.0

Scott Stender
Attacking Internationalized Software

Takayuki Sugiura
Winny P2P Security

Georg Wicherski & Thorsten Holz
Catching Malware to Detect, Track and Mitigate Botnets

Dan Larkin, Unit Chief, Internet Crime Complaint Center, Federal Bureau of Investigation
Keynote: Fighting Organized Cyber Crime – War Stories and Trends

Noel Anderson & Taroon Mandhana
WiFi in Windows Vista: A Peek Inside the Kimono

Ofir Arkin
Bypassing Network Access Control (NAC) Systems

Robert Auger & Caleb Sima
Zero Day Subscriptions: Using RSS and Atom Feeds as Attack Delivery Systems

Tod Beardsley
Investigating Evil Websites with Monkeyspaw: The Greasemonkey Security Professional's Automated Webthinger

Corey Benninger
Finding Gold in the Browser Cache

Renaud Bidou
IPS Shortcomings

Daniel Bilar
Automated Malware Classification/Analysis Though Network Theory and Statistics

Paul Böhm
Taming Bugs: The Art and Science of Writing Secure Code

Mariusz Burdach
Physical Memory Forensics

Jesse Burns
Fuzzing Selected Win32 Interprocess Communication Mechanisms

Jamie Butler, Nick Petroni & William Arbaugh
R^2: The Exponential Growth of Rootkit Techniques

johnny cache & David Maynor
Device Drivers

Brian Caswell & HD Moore
Thermoptic Camoflauge: Total IDS Evasion

Andrew Cushman
Microsoft Security Fundamentals: Engineering, Response and Outreach

Himanshu Dwivedi
I’m going to shoot the next person who says VLANs

Charles Edge
Attacking Apple’s Xsan

Dino Dai Zovi
Hardware Virtualization Based Rootkits

Shawn Embleton, Sherri Sparks & Ryan Cunningham
Sidewinder: An Evolutionary Guidance System for Malicious Input Crafting

David Endler & Mark Collier
Hacking VoIP Exposed

Chris Eng
Breaking Crypto Without Keys: Analyzing Data in Web Applications

FX
Analysing Complex Systems: the BlackBerry Case

Yuan Fan & Xiao Rong
MatriXay—When WebApp&Database Security Pen-Test/Audit Is a Joy

Pete Finnigan
How to Unwrap Oracle PL/SQL

Nicolas Fischbach
Carrier VoIP Security

Halvar Flake
RE 2006: New Challenges Need Changing Tools

Rob Franco
Case Study: The Secure Development Lifecycle and Internet Explorer 7

Stefan Frei & Dr. Martin May
The Speed of (In)security: Analysis of The Speed of Security vs Insecurity

Tom Gallagher
Finding and Preventing Cross-site request Forgery

Abolade Gbadegesin
The NetIO Stack: Reinventing TCP/IP in Windows Vista

Jeremiah Grossman & TC Niedzialkowski
Hacking Intranet Websites from the Outside "JavaScript malware just got a lot more dangerous"

Lukas Grunwald
New Attack RFID-systems and Their Middleware and Backends

Zvi Gutterman
Open to Attack: Vulnerabilities of the Linux Random Number Generator

Billy Hoffman
AJAX (in)security

Billy Hoffman
Analysis of Web Application Worms and Viruses

Greg Hoglund
Hacking World of Warcraft^®: An Exercise in Advanced Rootkit Design

David Hulton & Dan Moniz
Faster Pwning Assured: Hardware Hacks and Cracks with FPGAs

Dan Kaminsky
Black Ops 2006

William Kimball
Code Integration-Based Vulnerability Auditing

Alexander Kornbrust
Oracle Rootkits 2.0: The Next Generation

Dr. Neal Krawetz
You Are What You Type: Non-Classical Computer Forensics

John Lambert
Security Engineering in Windows Vista

Johnny Long
Death by 1000 Cuts

Johnny Long
Hacking, Hollywood Style

Kevin Mandia
The State of Incidence Response

Adrian Marinescu
Windows Vista Heap Management Enhancements– Security, Reliability and Performance

Claudio Merloni & Luca Carettoni
The BlueBag: A Mobile, Covert Bluetooth Attack and Infection Device

Doug Mohney
Defending Against Social Engineering with Voice Analytics

Dan Moniz & HD Moore
Six Degrees of XSSploitation

HD Moore
Metasploit Reloaded

Marco Morana
Building Security into the Software LifeCycle, A Business Case

Maik Morgenstern & Tom Brosch
Runtime Packers: The Hidden Problem?

Shawn Moyer
Defending Black Box Web Applications: Building an Open Source Web Security Gateway

Bala Neerumalla
SQL Injections by Truncation

Brendan O'Connor
Vulnerabilities in Not-So Embedded Systems

Bruce Potter
Bluetooth Defense Kit

Bruce Potter
The Trusted Computing Revolution

Tom Ptacek & Dave Goldsmith
Do Enterprise Management Applications Dream of Electric Sheep?

Jeremy Rauch
PDB: The Protocol DeBugger

Melanie Rieback
RFID Malware Demystified

Joanna Rutkowska
Subverting Vista Kernel For Fun And Profit

Hendrik Scholz
SIP Stack Fingerprinting and Stack Difference Attacks

SensePost
A Tale of Two Proxies

Saumil Shah
Writing Metasploit Plugins - From Vulnerability to Exploit

Jay Schulman
Phishing with Asterisk PBX

Peter Silberman & Jamie Butler
RAIDE: Rootkit Analysis Identification Elimination v1.0

Paul Simmonds, Henry Teng, Bob West & Justin Somaini
Jericho Forum and Challenge

Alexander Sotirov
Hotpatching and the Rise of Third-Party Patches

Kimber Spradlin & Dale Brocklehurst
Auditing Data Access Without Bringing Your Database To Its Knees

Jonathan Squire
$30, 30 minutes, 30 networks (Project Cowbird)

Alex Stamos & Zane Lackey
Breaking AJAX Web Applications: Vulns 2.0 in Web 2.0

Scott Stender
Attacking Internationalized Software

Michael Sutton & Greg MacManus
Punk Ode: Hiding Shellcode In Plain Sight

Alexander Tereshkin
Rootkits: Attacking Personal Firewalls

Philip Trainor
The Statue of Liberty: Utilizing Active Honeypots for Hosting Potentially Malicious Events

Franck Veysset & Laurent Butti
Wi-Fi Advanced Stealth

Jeff Waldron
VOIP Security Essentials

Chuck Willis & Rohyt Belani
Web Application Incident Response & Forensics: A Whole New Ball Game!

Emmanuelle Zambon & Damiano Bolzoni
NIDS: False Positive Reduction Through Anomaly Detection

Stefano Zanero
Host Based Anomaly Detection on System Call Arguments

Panels: Black Hat USA 2006

Center for Democracy and Technology Anti-Spyware Coalition Public Forum on Corporate Spyware Threats
Ari Schwartz, Ron Davidson, Gerhard Eschelbeck, John Heasman, Dan Kaminsky, Andre Gold, Phil Harris, Drew Maness, Eileen Harrington, Jerry Dixon

Disclosure (Public)
Jeff Moss, Paul Proctor, David Mortman, John Stewart, Derrick Scholl, Michael Sutton, Raven, Tom Ptacek, Pamela Fusco, Scott Blake, Jerry Dixon

Hacker Court
Panel

Meet the Feds: OODA Loop and the Science of Security
Jason Beckett, Ovie Carroll, James Christy, Andy Fried, Mike Jacobs, Ken Privette, Keith Rhodes, Dave Thomas, Bob Hopper, Hilary Stanhope, Tim Fowler

Welcome by Jeff Moss, Founder & CEO, Black Hat and

Eric Litt, Chief Information Security Officer, General Motors
Stuck in the Middle

Philippe Biondi, & Fabrice Desclaux
Silver Needle in the Skype

Shalom Carmel
IBM iSeries For Penetration Testers: Bypass Restrictions and Take Over Server

resources

Cesar Cerrudo
WLSI - Windows Local Shellcode Injection

exploits

Tzi-cker Chiueh
How to Automatically Sandbox IIS With Zero False Positive and Negative

white paper

Gregory Conti
Malware Cinema: A Picture is Worth a Thousand Packets

resources

bibliography

Halvar Flake
Attacks on Uninitialized Local Variables

John Heasman
Implementing and Detecting An ACPI BIOS Rootkit

Barnaby Jack
Exploiting Embedded Systems

Mikko Kiviharju
Hacking fingerprint Scanners - Why Microsoft's Fingerprint Reader Is Not a Security Feature

resources

Adam Laurie, Martin Herfurt, & Marcel Holtmann
Bluetooth Hacking - The State of The Art

Johnny Long
Death of a Thousand Cuts- Finding Evidence Everywhere!

Johnny Long
Hacking, Hollywood Style

Steve Manzuik and Andre Protas
Skeletons in Microsoft's Closet - Silently Fixed Vulnerabilities

Jarno Niemelä
Combatting Symbian Malware

white paper

Gunter Ollmann
Stopping Automated Application Attack Tools

Joanna Rutkowska
Rootkit Hunting vs. Compromise Detection

spoonm & skape
Beyond EIP

Alex Wheeler, Mark Dowd, & Neel Mehta
The Science of Code Auditing

Stefano Zanero
Anomaly Detection Through System Call Argument Analysis

Welcome by Jeff Moss, Founder & CEO, Black Hat

Dr. Linton Wells II, Principal Deputy Assistant Secretary of Defense (Networks and Information Integration)
Security Research and Vulnerability Disclosure

David Aitel
Nematodes

Mariusz Burdach
Finding Digital Evidence in Physical Memory

tools & docs

Max Caceres
Client Side Penetration Testing

Tzi-cker Chiueh
How to Automatically Sandbox IIS With Zero False Positive and Negative

Drew Copley
Angel Recon System (ARS) Prototype: Heuristic Vulnerability Analysis and Attack

tools

Halvar Flake
Attacks on Uninitialized Local Variables

Simson L. Garfinkel
New Directions in Disk Forensics

John Heasman
Implementing and Detecting An ACPI BIOS Rootkit

Billy Hoffman
Analysis of Web Application Worms and Viruses

code

Dan Kaminsky
Network Black Ops: Extracting Unexpected Functionality from Existing Networks

Arun Lakhotia
Analysis of Adversarial Code: Problem, Challenges, Results

David Litchfield
Breakable

Kevin Mandia
Foreign Attacks on Corporate America  (How the Federal Government can apply lessons learned from the private sector)

David Maynor & Robert Graham
SCADA Security and Terrorism: We're Not Crying Wolf!

Jarno Niemelä
Combatting Symbian Malware

Tom Parker & Matthew G. Devost
The Era of a Zero-Day Nation-State: Characterising the real threats to our nation’s critical information systems

Joanna Rutkowska
Rootkit Hunting vs. Compromise Detection

Marc Schoenefeld
Pentesting J2EE

spoonm & skape
Beyond EIP

Paul Syverson & Lasse Øverlier
Playing Server Hide and Seek on the Tor Anonymity Network

Irby Thompson & Mathew Monroe
FragFS: An Advanced NTFS Data Hiding Technique

tool

Stefano Zanero
My IDS is better than yours. Or is it?