http://www.securitybsides.com/BSidesLasVegas

Ryan Linn
Cain BeEF Hash: Snagging Passwords without Popping Boxes

http://www.securitybsides.com/BSidesLasVegas

Mike Kershaw (drag0rn)
Author of Kismet will talk about msf/lorcon/wifi pwnage & blind/semi-blind http ownage

http://www.securitybsides.com/BSidesLasVegas

Name: Jonathan Cran, http://www.rapid7.com / http://www.0x0e.org

Abstract: Penetration testing may be a loaded term, but what remains consistent is the need to gather large sets of data and analyze them. Regardless of whether you've worked on a globally distributed red team or you're pentesting your own company, it's easy to understand the need for good process tools for  penetration testing. This talk will demonstrate tactics, techniques and tools (some old, some new) that can be utilized in pentesting, collaborative or not. These will allow you to focus on the techical aspects of security testing, and give you "free" updates, reports and collaboration. Explanations and examples of real-world usage will be given, and you'll walk away with a set of tools that will allow you to participate in a world-class red team.

http://www.securitybsides.com/BSidesLasVegas

Name: Alex Hutton (@alexhutton) & David Mortman (@mortman):  http://www.newschoolsecurity.com

Abstract: We're really freaking tired of people who insist that information security & risk management remain a cargo cult.  So this discussion will center on what we need to do to escape ignorance:  that which we need to understand, how we should go about attempting to understand it, and how we can share our knowledge to ultimately do a better job.

http://www.securitybsides.com/BSidesLasVegas


HD Moore
Author of Metasploit will talk about WarVOX

http://www.securitybsides.com/BSidesLasVegas

Greg Martin - Exploiting Botnets for Profit and Fun

http://www.securitybsides.com/BSidesLasVegas

Moderator: Erin Jacobs http://www.secsocial.com

Abstract: Spun from the controversy over the Sec-xy Pillow Fight ( http://www.secpillowfight.com ) imagery, a group of women panelist shall assemble to discuss views on professional image and gender issues for females in the security industry. 

• Panelists:
  • Jennifer Jabbusch, CISO CAD, Inc. http://SecurityUncorked.com, @jjx
  • Leigh Honeywell, HackLab.TO, http://hypatia.ca , @hypatiadotca
  • Nicolle Neulist, Pumping Station: One, http://absentelements.blogspot.com, @rogueclown
  • Magen Hughes, http://www.tottenkoph.com, @tottenkoph

http://www.securitybsides.com/BSidesLasVegas

Name: Marisa Fagan (marisa@erratasec.com, Twitter: @errata); Elizabeth Wharton (elizabeth@erratasec.com, Twitter: @LawyerLiz)

Abstract: Everyone has a few skeletons in their closet: old relationships, former co-workers/employees, business rivals, and nosy neighbors they would like to forget. While breaking up is hard to do, what happens when one of these skeletons has a bone to pick with you or your company? Because of their proximity, certain people have unique access to personal information that can be used to compromise your online identity. As business continues to expand into the social media arena, and vice-versa, the potential reputation and monetary damage to your online identity becomes magnified.  Current ID Theft attack tree models fail to acknowledge this threat and legal protections are slow to respond. This talk will address current vulnerability and legal trends as well as give you the power through tips, tricks, and techniques to put the skeletons back in the closet.

http://www.securitybsides.com/BSidesLasVegasTalks

Name: David Rook, http://www.securityninja.co.uk

Abstract: The common approach towards secure development education is to discuss a small set of common vulnerabilities instead of telling developers how to develop securely. We don't teach people to drive by giving learner drivers a list of the common ways to crash so why do we do this with developers? This presentation will discuss a small set of secure development principles that developers can follow without having to know the intricate details of any web application vulnerability. "Teach a developer about a vulnerability and he will prevent it, teach him how to develop securely and he will prevent many vulnerabilities".

http://www.securitybsides.com/BSidesLasVegas

Name: Damon Cortesi @dacort;  http://alchemysecurity.com/

Abstract: Discussion of the inherent lack of security on social networks such as Twitter, and the challenges of organizations in the web 2.0 space to build and maintain a secure web application. Damon will take a look at a few startups from the past year and examine the different types of failure they have experienced from a security perspective. The inherent risks of communication via social networks will also be discussed. Whether it's malware propagation or a lack of fine-grained access controls, your data is at risk no matter how hard you may try to protect it.

http://www.securitybsides.com/BSidesLasVegas

Luis Corrons @luis_corrons;  http://pandalabs.pandasecurity.com/

Back in October 2008 PandaLabs published findings from a comprehensive study on the rogueware economy which concluded that the cybercriminals behind fake antivirus software applications were generating upwards of $15 million per month. This session will showcase findings from a new PandaLabs report that examines the evolution of the rogue antivirus economy and the increasingly sophisticated social engineering techniques deployed by cybercriminals to generate even greater returns, including the rise of Twitter trending malware and Blackhat SEO campaigns. Participants will also gain visibility into the current economics of rogueware, with previously unpublished findings that reveal hard dollar figures, corrupt affiliate systems, and free hosting services. Finally, the session will share PandaLabs’ recent findings and analysis on the different social network distribution methods (e.g. Digg, Facebook, MySpace, Twitter, etc.) and uncover the unique vulnerabilities of each platform.