Thursday 5 October 12:00 - 12:30, Red room
Andrew Brandt (Symantec)
Trickbot, which appeared this year, seems to be a new, more modular, and more extensible malware descendant of the notorious Dyre botnet trojan. Like Dyre, Trickbot communicates with its command-and-control network over TLS-encrypted channels, which it uses both to exfiltrate an enormously detailed profile of the infected machine and any stolen data, as well as to receive payloads and instructions.
This session will comprise a walkthrough of a typical Trickbot infection process, and its aftermath, as seen through the lens of a tool used to perform man-in-the-middle decryption. To collect this information, I infected a number of both virtual and bare-metal devices with Trickbot and then permitted the infected machines to beacon for anywhere from a few hours to a few weeks, all the while MITM-ing the traffic and recording it on a retrospective analysis tool. Finally, we will report our observations about the general behavioural rules that Dyre follows, and offer practical advice to incident responders or malware analysts who might need to identify a Trickbot infection, or deal with the consequences of its aftermath.
Thiago Marques (Kaspersky Lab)
Fabio Assolini (Kaspersky Lab)
Of all the forms of attack against financial institutions in the world, the ones that are most likely to combine traditional…
John Graham-Cumming (Cloudflare)
In February 2017, Cloudflare was revealed to have been leaking private information including HTTP headers, cookies and POST data…
Tyrus Kamau (Euclid Consultancy)
The cyber threats Kenya faces range from basic hacking such as website defacements, financial fraud, social media account…