Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1

Posted by   Martijn Grooten on   Aug 3, 2017

With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also often look back at past conference presentations, not just because we are proud to have had them presented at our conference, but because their content is still very relevant today.

In a two-part blog post, I look back at ten conference papers from the last ten conferences (not by coincidence covering my own tenure at VB) that I often think back of, and that remain relevant.


The strange case of Julie Amero

Early in 2007, Julie Amero, a substitute teacher from Connecticut, was tried and convicted of four counts of risk of injury to a minor, as she was believed to have been browsing pornography while teaching a class of 12-year-olds. However, she wasn't: her computer had been infected with spyware, which led to the adult content being shown on her machine in the same room as her students. Appalled at the injustice, a group of industry experts joined forces to assist in Ms Amero's case and overturn the conviction; details of the case and the forensic investigations that provided the all-important data that ultimately proved Ms Amero's innocence were presented in a VB2017 paper by one of those industry experts, Alex Shipp.

VB2007 was my first Virus Bulletin conference, and as my role at the company back then wasn't directly related to security, I mostly worked behind the scenes and only saw a few talks — of which, Alex's was my first. The impression it gave me, and which has been confirmed many times since then, was that these people really cared about making the world more secure, and it has never left me.


The NorTel Mailer: effective open-source spam filtering for enterprises

Spam, as a book I recently read explained, started as a nuisance within a community and the efforts to fight it have deep roots in (open-source) community tools and projects. At his then employer Nortel, Chris Lewis had used such tools to build an impressive framework to detect and stop spam, details of which he presented at VB2008 in Ottawa.

The flexibility these tools gave him may not be necessary for your average organization, but it was exactly what I was looking for for the spam-filter test I was building at the time. Many ideas from Chris's presentation are still evident in how this test is built.


The Partnerka — what is it, and why should you care?

With, according to Google, 37 academic citations, Dmitry Samosseiko's VB2009 paper on the 'Partnerka' is definitely one of the most influential in VB's history. The affiliate networks described in the paper have since become well known among those researching cybercrime, but at the time the paper (pdf) was presented in Geneva, the industry had barely moved beyond the mindset of believing the adversary to be a child operating from their parents' basement. The idea that there were complex business structures behind most cybercrime opened the eyes of many and the paper provided the research community with the first thorough research into such structures.


An indepth look into Stuxnet

It has been said that the summer of 2010 was when the security industry lost its innocence: it was then that Stuxnet was discovered. Whether or not one sees it as dramatically as this, Stuxnet was certainly a defining moment in the history of computer security (I highly recommend Kim Zetter's book on it), and we were lucky that its discovery coincided with the call for last-minute papers for the conference.

Such was the importance of the discovery that at VB2010 in Vancouver there were not one but two last-minute presentations on Stuxnet — with press flying in from around the world to attend. Of the two presentations, it was that of Liam O'Murchu that was most memorable for me: Liam explained how Stuxnet modified the PLC in the nuclear plant it had targeted to make the centrifuges spin faster. To demonstrate the concept behind this, he built a simple device that inflated a balloon and then wrote a piece of code that modified the PLC on the device to prevent the inflation from stopping, thus resulting in a big bang — and a seriously impressed audience.


Modern bootkit trends: bypassing kernel-mode signing policy

Together with Sergey Bratus, Eugene Rodionov and Alex Matrosov are the authors of a book on rootkits and bootkits. Eugene and Alex's expertise in this subject has long been established, for instance through a number of VB conference talks, the first of which they delivered at VB2011 in Barcelona, when they looked at various cases of bootkits that managed to bypass various security enhancements introduced in x64-bit Windows.

Next Thursday I will complete my list, taking a look back at another five memorable papers from VB conferences past.

In the meantime, if this has whet your appetite, check out the programme for this year's conference, and book your ticket for what promises to be another memorable event!



Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.