Black Hat USA 2007 Briefings and Training
Caesars Palace, Las Vegas • July 28-29 (Weekend) & July 30-31 (Weekday)

The course will provide attendees with an in-depth understanding of how advanced stealth malware works, how it interacts with the operating system, underlying hardware and network. Attendees will have a chance to run, analyze and experiment with several previously unpublished samples of proof-of-concept rootkits, similar to Deepdoor, FireWalk, Blue Pill and others. The malware samples will be created from scratch (and in a slightly different way) exclusively for the use during the training, as the original implementations can not be used due to NDA restrictions.

Simpler stealth malware will also be briefly covered as well as approaches to its detection, so that participants get a clear understanding what advantages the more sophisticated malware offers to attackers.

This course is focused on Windows systems (and Vista x64 specifically), although some of the concepts presented, like e.g. Blue Pill-like malware or methods for cheating hardware based memory acquisition, are OS-independent.

There will be a significant amount of previously unpublished techniques, code, and ideas presented during this training, including new ways to subvert Vista x64 kernel on the fly. The two classes offered during Black Hat USA 2007 will be the only public classes of this course available in 2007.

 Key topics

Overview of Traditional Rootkit Technology (TRT)
Stealth by Design malware (SbD)
“Data hooking only” malware (Type II infections)
Advanced NDIS traffic filtering and PFWs bypassing
Vista x64 kernel protection: challenges and solutions
Virtualization: (anti)malware beyond the OS
Malware beyond the CPU

Joanna Rutkowska is a recognized researcher in the field of stealth malware and system compromises. Over the past several years she has introduced several breakthrough concepts and techniques on both the offensive and defensive side in this field. Her work has been quoted multiple times by international press and she is also a frequent speaker at security conferences around the world.

Check out Joanna's blog on her training.

Alexander Tereshkin, aka 90210, is a seasoned reverse engineer and expert into Windows kernel, specializing in rootkit technology and kernel exploitation. He presented several sophisticated ideas for rootkit creation and personal firewall bypassing in the past few years. During the last year, when working for COSEINC Advanced Malware Labs, he has done significant work in the field of virtualization based malware and kernel protection bypassing.