Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1

Posted by   Martijn Grooten on   Aug 3, 2017

With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also often look back at past conference presentations, not just because we are proud to have had them presented at our conference, but because their content is still very relevant today.

In a two-part blog post, I look back at ten conference papers from the last ten conferences (not by coincidence covering my own tenure at VB) that I often think back of, and that remain relevant.


The strange case of Julie Amero

Early in 2007, Julie Amero, a substitute teacher from Connecticut, was tried and convicted of four counts of risk of injury to a minor, as she was believed to have been browsing pornography while teaching a class of 12-year-olds. However, she wasn't: her computer had been infected with spyware, which led to the adult content being shown on her machine in the same room as her students. Appalled at the injustice, a group of industry experts joined forces to assist in Ms Amero's case and overturn the conviction; details of the case and the forensic investigations that provided the all-important data that ultimately proved Ms Amero's innocence were presented in a VB2017 paper by one of those industry experts, Alex Shipp.

VB2007 was my first Virus Bulletin conference, and as my role at the company back then wasn't directly related to security, I mostly worked behind the scenes and only saw a few talks — of which, Alex's was my first. The impression it gave me, and which has been confirmed many times since then, was that these people really cared about making the world more secure, and it has never left me.


The NorTel Mailer: effective open-source spam filtering for enterprises

Spam, as a book I recently read explained, started as a nuisance within a community and the efforts to fight it have deep roots in (open-source) community tools and projects. At his then employer Nortel, Chris Lewis had used such tools to build an impressive framework to detect and stop spam, details of which he presented at VB2008 in Ottawa.

The flexibility these tools gave him may not be necessary for your average organization, but it was exactly what I was looking for for the spam-filter test I was building at the time. Many ideas from Chris's presentation are still evident in how this test is built.


The Partnerka — what is it, and why should you care?

With, according to Google, 37 academic citations, Dmitry Samosseiko's VB2009 paper on the 'Partnerka' is definitely one of the most influential in VB's history. The affiliate networks described in the paper have since become well known among those researching cybercrime, but at the time the paper (pdf) was presented in Geneva, the industry had barely moved beyond the mindset of believing the adversary to be a child operating from their parents' basement. The idea that there were complex business structures behind most cybercrime opened the eyes of many and the paper provided the research community with the first thorough research into such structures.


An indepth look into Stuxnet

It has been said that the summer of 2010 was when the security industry lost its innocence: it was then that Stuxnet was discovered. Whether or not one sees it as dramatically as this, Stuxnet was certainly a defining moment in the history of computer security (I highly recommend Kim Zetter's book on it), and we were lucky that its discovery coincided with the call for last-minute papers for the conference.

Such was the importance of the discovery that at VB2010 in Vancouver there were not one but two last-minute presentations on Stuxnet — with press flying in from around the world to attend. Of the two presentations, it was that of Liam O'Murchu that was most memorable for me: Liam explained how Stuxnet modified the PLC in the nuclear plant it had targeted to make the centrifuges spin faster. To demonstrate the concept behind this, he built a simple device that inflated a balloon and then wrote a piece of code that modified the PLC on the device to prevent the inflation from stopping, thus resulting in a big bang — and a seriously impressed audience.


Modern bootkit trends: bypassing kernel-mode signing policy

Together with Sergey Bratus, Eugene Rodionov and Alex Matrosov are the authors of a book on rootkits and bootkits. Eugene and Alex's expertise in this subject has long been established, for instance through a number of VB conference talks, the first of which they delivered at VB2011 in Barcelona, when they looked at various cases of bootkits that managed to bypass various security enhancements introduced in x64-bit Windows.

Next Thursday I will complete my list, taking a look back at another five memorable papers from VB conferences past.

In the meantime, if this has whet your appetite, check out the programme for this year's conference, and book your ticket for what promises to be another memorable event!



Latest posts:

In memoriam: Prof. Ross Anderson

We were very sorry to learn of the passing of Professor Ross Anderson a few days ago.

In memoriam: Dr Alan Solomon

We were very sorry to learn of the passing of industry pioneer Dr Alan Solomon earlier this week.

New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

VB2021 localhost videos available on YouTube

VB has made all VB2021 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.