Security experts gather in Europe

Posted by   Virus Bulletin on   May 7, 2008

Anti-malware insights pooled at AMTSO, CARO and EICAR meetings.

Many of the world's leading anti-malware and security experts came together in the past week, at a string of meetings and conferences being held in Europe. Global bodies the Anti-Malware Testing Standards Organisation (AMTSO) and the Computer Anti-Virus Researchers' Organization (CARO), and the pan-European experts group EICAR, all held meetings to discuss the latest developments in the battle against the malware menace.

The AMTSO group, formed earlier this year at a meeting in Bilbao, came together for a second time in Amsterdam last week, to discuss ways of improving security testing to better reflect the evolving capabilities of security software. An even larger number of delegates - representing the security industry, testing bodies, media organisations and academia - shared their knowledge and ideas in hopes of ensuring higher standards of testing, enabling the public to gain a clearer insight into the performance of security software.

CARO The veteran CARO organisation played hosts to a conference dedicated to the subject of testing held in Reykjavik, Iceland last year, during which the movement to found AMTSO began to take shape. This year CARO held a second highly focused two-day workshop, also in Amsterdam following on from the AMTSO meeting. Attended by over 120 delegates from around the world, the conference looked in detail at the problems presented by packed, encrypted and obfuscated malicious code.

The proceedings were opened with a keynote speech from Paul Ducklin of Sophos, providing an overview of the problems posed by packing and obfuscation. Over the following days, experts from many of the leading security firms as well as independent organisations presented their own insights into the issues, looking at anti-analysis techniques used in web code as well as executables, among them Roger Thompson of Exploit Prevention Labs (now part of AVG) fame. Ilfak Guilfanov, creator of the IDA Pro disassembler, widely considered a vital tool in malware analysis, provided a highlight for many delegates with his talk, looking at the configurability of his software to deal with deliberate obscurity. In between the presentations, the usual social events provided more opportunities for networking, debate and knowledge-sharing.

Many of the delegates then moved on to France, where the annual EICAR conference was held after a hiatus in 2007. Over several days, a wide range of papers were presented by both academics and industry experts covering various aspects of malware behaviour and analysis, botnets, software vulnerabilities and cryptography. EICAR's Eddy Willems will provide a detailed look at the event in the next issue of Virus Bulletin, available to subscribers only; subscription information is here.

Later in the year the 2008 Virus Bulletin conference will be held in Ottawa, Canada. The VB2008 conference programme boasts an exceptional line-up of expert speakers and caters for both technical and corporate audiences. Presentations will cover subjects including: sample sharing, anti-malware testing, automated analysis, rootkits, spam and botnet tracking techniques, corporate policy, business risk and more. VB2008 takes place 1-3 October 2008, the full programme and online registration can be found here.

Posted on 07 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.