Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1

Posted by   Martijn Grooten on   Aug 3, 2017

With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also often look back at past conference presentations, not just because we are proud to have had them presented at our conference, but because their content is still very relevant today.

In a two-part blog post, I look back at ten conference papers from the last ten conferences (not by coincidence covering my own tenure at VB) that I often think back of, and that remain relevant.


The strange case of Julie Amero

Early in 2007, Julie Amero, a substitute teacher from Connecticut, was tried and convicted of four counts of risk of injury to a minor, as she was believed to have been browsing pornography while teaching a class of 12-year-olds. However, she wasn't: her computer had been infected with spyware, which led to the adult content being shown on her machine in the same room as her students. Appalled at the injustice, a group of industry experts joined forces to assist in Ms Amero's case and overturn the conviction; details of the case and the forensic investigations that provided the all-important data that ultimately proved Ms Amero's innocence were presented in a VB2017 paper by one of those industry experts, Alex Shipp.

VB2007 was my first Virus Bulletin conference, and as my role at the company back then wasn't directly related to security, I mostly worked behind the scenes and only saw a few talks — of which, Alex's was my first. The impression it gave me, and which has been confirmed many times since then, was that these people really cared about making the world more secure, and it has never left me.


The NorTel Mailer: effective open-source spam filtering for enterprises

Spam, as a book I recently read explained, started as a nuisance within a community and the efforts to fight it have deep roots in (open-source) community tools and projects. At his then employer Nortel, Chris Lewis had used such tools to build an impressive framework to detect and stop spam, details of which he presented at VB2008 in Ottawa.

The flexibility these tools gave him may not be necessary for your average organization, but it was exactly what I was looking for for the spam-filter test I was building at the time. Many ideas from Chris's presentation are still evident in how this test is built.


The Partnerka — what is it, and why should you care?

With, according to Google, 37 academic citations, Dmitry Samosseiko's VB2009 paper on the 'Partnerka' is definitely one of the most influential in VB's history. The affiliate networks described in the paper have since become well known among those researching cybercrime, but at the time the paper (pdf) was presented in Geneva, the industry had barely moved beyond the mindset of believing the adversary to be a child operating from their parents' basement. The idea that there were complex business structures behind most cybercrime opened the eyes of many and the paper provided the research community with the first thorough research into such structures.


An indepth look into Stuxnet

It has been said that the summer of 2010 was when the security industry lost its innocence: it was then that Stuxnet was discovered. Whether or not one sees it as dramatically as this, Stuxnet was certainly a defining moment in the history of computer security (I highly recommend Kim Zetter's book on it), and we were lucky that its discovery coincided with the call for last-minute papers for the conference.

Such was the importance of the discovery that at VB2010 in Vancouver there were not one but two last-minute presentations on Stuxnet — with press flying in from around the world to attend. Of the two presentations, it was that of Liam O'Murchu that was most memorable for me: Liam explained how Stuxnet modified the PLC in the nuclear plant it had targeted to make the centrifuges spin faster. To demonstrate the concept behind this, he built a simple device that inflated a balloon and then wrote a piece of code that modified the PLC on the device to prevent the inflation from stopping, thus resulting in a big bang — and a seriously impressed audience.


Modern bootkit trends: bypassing kernel-mode signing policy

Together with Sergey Bratus, Eugene Rodionov and Alex Matrosov are the authors of a book on rootkits and bootkits. Eugene and Alex's expertise in this subject has long been established, for instance through a number of VB conference talks, the first of which they delivered at VB2011 in Barcelona, when they looked at various cases of bootkits that managed to bypass various security enhancements introduced in x64-bit Windows.

Next Thursday I will complete my list, taking a look back at another five memorable papers from VB conferences past.

In the meantime, if this has whet your appetite, check out the programme for this year's conference, and book your ticket for what promises to be another memorable event!



Latest posts:

The spam that is hardest to block is often the most damaging

We see a lot of spam in the VBSpam test lab, and we also see how well such emails are being blocked by email security products. Worryingly, it is often the emails with a malicious attachment or a phishing link that are most likely to be missed.

Throwback Thursday: We're all doomed

Mydoom turns 15 this month, and is still being seen in email attachments. This Throwback Thursday we look back to March 2004, when Gabor Szappanos tracked the rise of W32/Mydoom.

VB2019 call for papers - now open!

Have you analysed a new online threat? Do you know a new way to defend against such threats? Are you tasked with securing systems and fending off attacks? The call for papers for VB2019 is now open and we want to hear from you!

VB2018 paper: Unpacking the packed unpacker: reversing an Android anti-analysis library

Today, we publish a VB2018 paper by Google researcher Maddie Stone in which she looks at one of the most interesting anti-analysis native libraries in the Android ecosystem. We also release the recording of Maddie's presentation.

VB2018 paper: Draw me like one of your French APTs – expanding our descriptive palette for cyber threat actors

Today, we publish the VB2018 paper by Chronicle researcher Juan Andres Guerrero-Saade, who argues we should change the way we talk about APT actors.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.