"Until now network security defences have largely been about building walls and fences around the network. This talk revolves around spiking those walls & electrifying those fences! During this talk we will highlight techniques (and tools) that can be used to turn the tables on prospective attackers with passive-Strike-Back. We will explore the possibilities across the assesment spectrum responding to the standard assesment phases of Intelligence gathering, Reconnaissance & Attack with D...
Oct 31, 2006•1 hr 32 min
"ARAI Shunichi is the chair of freekaneko.com which supports Winny's author Isamu Kaneko. He raised 16 million yen defense fund in a month. He is now researching on anonymity technology and distributed systems as Ph.D. student at Waseda university. He is also a founder and CEO of Mellowtone inc. Arai started programming at age of 3, and now he is certified as `genius programmer' by Japanese government. Co-translator of ""Applied Cryptography"" Japanese translation. ARAI Shunichi is the chair of ...
Oct 31, 2006•52 min
"Virtually every virus and worm that circulates the Internet today is ""protected"" by some form of obfuscation that hides the code's true intent. In the Window's world where worms prevail, the use of tools such as UPX, ASPack, and teLock has become standard. Protection of malicious code is not the only goal of binary obfuscators however which can be used to protect intellectual property. In the Linux world, tools such as Burneye and Shiva exist which can be used in ways similar to any Window's ...
Oct 31, 2006•32 min
"With the cost of security experts increasing each year, it is expensive to audit critical systems as often as is needed. Worse yet, it is difficult to know how much to trust the reports since the worst consultants give the most positive answers. In order to address this problem, Caezar proposes a system for ranking the merit of security experts alone or in teams. Based on his years of experience with DEFCON Capture the Flag games, Caezar shows the difficulty of solving this problem in a fair an...
Oct 31, 2006•1 hr 25 min
Jeff Moss welcomes delegates of the 2004 BlackHat Japan conference and introduces a panel of security experts for a Q&A.
Oct 31, 2006•1 hr 14 min
Closing ceremonies and speech given by Jeff Moss.
Oct 31, 2006•6 min
"Until now network security defences have largely been about building walls and fences around the network. This talk revolves around spiking those walls & electrifying those fences! During this talk we will highlight techniques (and tools) that can be used to turn the tables on prospective attackers with passive-Strike-Back. We will explore the possibilities across the assesment spectrum responding to the standard assesment phases of Intelligence gathering, Reconnaissance & Attack with D...
Oct 31, 2006•1 hr 32 min
"New vulnerabilities to networks are discovered and published on a daily base. With each such announcement, the same questions arise. How significant is this vulnerability? How prevalent is this vulnerability? How easy is this vulnerability to exploit? Are any of my systems affected by this vulnerability? Due to lack of global vulnerability data, answers to these questions are often hard to find and risk rating is even more difficult. As part of ongoing research, Gerhard Eschelbeck of Qualys, In...
Oct 31, 2006•1 hr 22 min
"Security professionals see the compromise of networked systems on a day to day basis. It's something they've come to expect. The blatant exploitation of operating systems, applications, and configurations is a common event and is taken into account by most security engineers. But a different type of security compromise threatens to crumble the underlying security of the modern organization. There are forms of communication that transfer sensitive data outside of organizations every day. Covert ...
Oct 31, 2006•2 hr 25 min
"Windows 2000 SP3 or later and Windows XP now use a new network logon authentication method by default, the NTLM2 Session Response. Employed by Windows 2000, this unproven authentication method is considered to reduce the vulnerability found in network LM and NTLM v1 authentication. In this session, we will describe and demonstrate our audit approach for detecting easy-to-crack passwords from packets traveling on the network in real time. This approach was developed based on our thorough investi...
Oct 31, 2006•52 min
Closing ceremonies and speech given by Jeff Moss.
Oct 31, 2006•6 min
" * Chairman, Ochanomizu Associates, Tokyo, Japan * Senior Advisor, Commission on Japanese Critical Infrastructure Protection * Research Counselor and Trustee, Institute for International Policy Studies, Tokyo * Vice President, Japan Forum for Strategic Studies Mr. Miyawaki is Japan's leading expert on the role of organized crime in Japan's economy. He joined the Japanese National Police Agency (NPA) in 1956, ultimately becoming director of the NPA's criminal investigation division, where he hea...
Oct 31, 2006•48 min
"Hardware security is often overlooked during a product's development, which can leave it vulnerable to hacker attacks resulting in theft of service, loss of revenue, identity theft, unauthorized network access, or a damaged reputation. This presentation will show you how to reduce the number of vulnerabilities in your embedded hardware designs and how to evaluate the threats against your products. Learning from history is important to avoid repeating old design flaws, so we will also look at pr...
Oct 31, 2006•1 hr 21 min
"In the case of vulnerabilities which allow the execution of arbitrary machine code, the reliability of exploitation is swayed by the type of vulnerability, the conditions surrounding the vulnerable code, and the attack vector, among other considerations. The reliability of exploitation an important factor for those attempting to exploit a vulnerability'especially so for worm and virus writers'so therefore it is also an important consideration for the threat analysis of security vulnerabilities....
Oct 31, 2006•42 min
Cybercrime Treaty and Legal Environment of Japanese Computer Crime and Laws
Oct 31, 2006•48 min
"David Litchfield leads the world in the discovery and publication of computer security vulnerabilities. This outstanding research was recognised by Information Security Magazine who voted him as 'The World's Best Bug Hunter' for 2003. To date, David has found over 150 vulnerabilities in many of today's popular products from the major software companies (the majority in Microsoft, Oracle). David is also the original author for the entire suite of security assessment tools available from NGSSoftw...
Oct 31, 2006•54 min
"ARAI Shunichi is the chair of freekaneko.com which supports Winny's author Isamu Kaneko. He raised 16 million yen defense fund in a month. He is now researching on anonymity technology and distributed systems as Ph.D. student at Waseda university. He is also a founder and CEO of Mellowtone inc. Arai started programming at age of 3, and now he is certified as `genius programmer' by Japanese government. Co-translator of ""Applied Cryptography"" Japanese translation. ARAI Shunichi is the chair of ...
Oct 31, 2006•52 min
"Windows 2000 SP3 or later and Windows XP now use a new network logon authentication method by default, the NTLM2 Session Response. Employed by Windows 2000, this unproven authentication method is considered to reduce the vulnerability found in network LM and NTLM v1 authentication. In this session, we will describe and demonstrate our audit approach for detecting easy-to-crack passwords from packets traveling on the network in real time. This approach was developed based on our thorough investi...
Oct 31, 2006•53 min
"This presentation explores the explosive growth of a technique known as ""Google Hacking"". When the modern security landscape includes such heady topics as ""blind SQL injection"" and ""integer overflows"", it's refreshing to see such a deceptively simple tool bent to achieve such amazing results; this is hacking in the purest sense of the word. Attendees will learn how to torque Google to detect SQL injection points and login portals, execute portscans and CGI scans, fingerprint web servers, ...
Oct 31, 2006•1 hr 28 min
"Virtually every virus and worm that circulates the Internet today is ""protected"" by some form of obfuscation that hides the code's true intent. In the Window's world where worms prevail, the use of tools such as UPX, ASPack, and teLock has become standard. Protection of malicious code is not the only goal of binary obfuscators however which can be used to protect intellectual property. In the Linux world, tools such as Burneye and Shiva exist which can be used in ways similar to any Window's ...
Oct 31, 2006•1 hr 30 min
"This presentation explores the explosive growth of a technique known as ""Google Hacking"". When the modern security landscape includes such heady topics as ""blind SQL injection"" and ""integer overflows"", it's refreshing to see such a deceptively simple tool bent to achieve such amazing results; this is hacking in the purest sense of the word. Attendees will learn how to torque Google to detect SQL injection points and login portals, execute portscans and CGI scans, fingerprint web servers, ...
Oct 31, 2006•1 hr 21 min
"Hardware security is often overlooked during a product's development, which can leave it vulnerable to hacker attacks resulting in theft of service, loss of revenue, identity theft, unauthorized network access, or a damaged reputation. This presentation will show you how to reduce the number of vulnerabilities in your embedded hardware designs and how to evaluate the threats against your products. Learning from history is important to avoid repeating old design flaws, so we will also look at pr...
Oct 31, 2006•1 hr 28 min
![Black Hat Briefings, Japan 2004 [Audio] Presentations from the security conference - podcast cover](https://assets.metacast.app/images/podcast/artwork/EKfNDweE)
