BlackHat Musings, With a Small Rant Thrown In

Yesterday was a rather interesting day for several reasons. I had the opportunity to attend several briefings (which I will get to in a moment), schmooze with vendors (always fun), but best of all socialize with old friends from the old skool (translation: act like a pirate).

The vibe has been changing at BlackHat for quite some time now. It has for several years been becoming more mainstream and (dare I say it) even respectable. Don’t get me wrong: So far the presentations have been good and many of the security industry’s best minds put in a good showing; but there is a difference from years past. IMHO many of the topics seem soooo 10 minutes ago. Same people talking about the same stuff. BluPill and Vitriol…100% Detectable vs Nothing is 100% detectable…Pen Testing…Fuzzing…Wireless pwning. … Some new techniques but nothing really that has not been discussed before. So far I have come away with the thought that they are saving the really good stuff for another convention. And the fed has never been easier to spot.

I tend to judge security research by what its impact on malware will be. Will it create more malware? Will it create better malware? How will this hurt users or impact the enterprise? Will this result in easier zero-day creation? Will this allow malware to be more stealthful? That kinda thing…I sometimes wonder if most of the researchers consider that type of impact from their work; or do they ignore that aspect of it?

More in a bit…