Live from VB2007 – part 2

Welcome, from the capital of Austria and the floor of the second day of the 2007 VirusBulletin conference. Today has proved another exciting day in the Anti-Malware world with presentations from our very own Joe Telafici and Dmitry Gryaznov co-presenting on how the AV community are DoS-ing themselves by collecting and swapping malware.

Joe and Dmitry on stage
In addition Dmitry presented, on behalf of Ahmed Sallam, the topic of “Terminating Hidden Processes”. This topic was very interesting and covered the popular tactic used by rootkits to hide their process from user land applications. A side effect of this is that the termination of this hidden process can cause serious instability in the operating system and often BSODs if a new application is launched post termination. This instability occurs because the pointers to and from one process to another are manipulated by the rootkit. Ahmed’s paper contained suggestions on fixes to this problem and how our Rootkit Detective is not affected.

In some shameless self-promotion my (first VirusBulletin) presentation from yesterday was referenced no less than three times today by other security professionals. Josh Harriman (Symantec) mentioned it this morning when referring to remediation of more complex threats, whilst Roel Schouwenberg (Kaspersky) mentioned it during his last-minute presentation on “Targeted banker malware on demand” (referring to a variant of W32/Alvabrig) as too did Kurt Baumgartner (PC Tools) in his presentation “Storm – Malware 2.0 has arrived”.

Me discussing a patched wininet.dll file
A special event occurred today – the introduction of last-minute presentations! Based on feedback from last year’s VirusBulletin conference it was agreed that, in order to encourage papers and presentations covering up-to-the-minute malware and research topics, security professionals were invited to submit papers just two weeks before the conference itself. Eight presentations (of 20 minutes each) ran back to back in the technical stream of this afternoon’s schedule. All the presentations were good and indeed most were very topical.

Tonight is the gala dinner and cabaret, which should be very entertaining, so until tomorrow it’s goodbye from me!